Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
29/06/2024, 11:14
General
-
Target
2024-06-29_931a009c1c430c6d1bfcd56424666a23_goldeneye.exe
-
Size
168KB
-
MD5
931a009c1c430c6d1bfcd56424666a23
-
SHA1
ae862029ba6e50ae9dd5e7ce6df58b4026d780d2
-
SHA256
1883c1aca345f266478bd50a1b94522a70bd8081f50de5af29a5cfcf869dcac5
-
SHA512
c08c38473ad74339ea5b3826f80fede1a103fadbe335d5e7ba6033a42fce26effec176027e855a3b7cc1305478acec79b7fdb4b44aca89fc6b07ac97feaa19d4
-
SSDEEP
1536:1EGh0oYlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oYlqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-29_931a009c1c430c6d1bfcd56424666a23_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-29_931a009c1c430c6d1bfcd56424666a23_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FFEAE45C-4266-4aff-924F-AB27F0325884}.exeC:\Windows\{FFEAE45C-4266-4aff-924F-AB27F0325884}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{143788D9-4693-447c-BB8C-19544043F52B}.exeC:\Windows\{143788D9-4693-447c-BB8C-19544043F52B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F54C24BC-4B60-4416-917E-83AEE14E7AB2}.exeC:\Windows\{F54C24BC-4B60-4416-917E-83AEE14E7AB2}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1BE9BAAA-80C7-45c1-A4D2-6BCA7AD578F2}.exeC:\Windows\{1BE9BAAA-80C7-45c1-A4D2-6BCA7AD578F2}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E9807F8-63B8-4fa4-BA79-02D6D756104A}.exeC:\Windows\{0E9807F8-63B8-4fa4-BA79-02D6D756104A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{477FE129-5FFC-425d-98E9-91A07B528A1B}.exeC:\Windows\{477FE129-5FFC-425d-98E9-91A07B528A1B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3FCC5D4-BEA5-4ab8-9797-61696E3059B9}.exeC:\Windows\{B3FCC5D4-BEA5-4ab8-9797-61696E3059B9}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{13235294-715E-454a-885C-8AA31AA8F24F}.exeC:\Windows\{13235294-715E-454a-885C-8AA31AA8F24F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C854C58-4452-4524-B609-BAE4867D42B3}.exeC:\Windows\{3C854C58-4452-4524-B609-BAE4867D42B3}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F3657051-C412-4911-A7E9-85813D6FD51E}.exeC:\Windows\{F3657051-C412-4911-A7E9-85813D6FD51E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C800A38-9423-4337-B294-381D38E2F6EE}.exeC:\Windows\{6C800A38-9423-4337-B294-381D38E2F6EE}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{AE7538D5-8552-4592-84AA-60ED6D4587A8}.exeC:\Windows\{AE7538D5-8552-4592-84AA-60ED6D4587A8}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C800~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3657~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C854~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13235~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3FCC~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{477FE~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E980~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1BE9B~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F54C2~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14378~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FFEAE~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5267661061e68d5e70d05149fce5744c5
SHA1b57ee362f83e289eb0cda8deea5b5a370f5a46b4
SHA25674dfe5691c1a3a56801539c172087ed23206651c6f54ac93343b695662ffc5be
SHA512f5c4e7ae45293c66b90495bd29e8a4c6801dd5049f6e9c385fed9dae6dca192504dd09075b23c5cd83baf4590ca620a95b898337f3f01df8198bdf8a27b30dc4
-
Filesize
168KB
MD581ef9e8491c151c56dbdbca6f00c9687
SHA1c6fd642016dc4ae6968de63217450e7f23cbb027
SHA25631d9302a245343fbebf580aae485b39956ad4e725f8396e99f66e448e9b61b8a
SHA51272b2f5fed7d9aff35f8ee491eb78c62effad1ebd7bbc16b3b1eb5ff7bb55b14dd46d80c37e09d6c03191f6025d0e3201a8b92d0cb93a005a02008f03362add68
-
Filesize
168KB
MD504b33b34516f8f54bdcedbf60bd17967
SHA150f164350bb0ceb7ac150847ff085e720b9db088
SHA25641272d22f41beb658748cccd1043c08d4065bcf2f97fbe4d42a65c225c02e613
SHA51252e8d3a5a2c161bd1c48857939853e76989df98b94945dce76b4d22f269940f4c1d33e7041d3a5ff19d8000b88cf678d8f4e3bd38e86dc658211d76bf932f042
-
Filesize
168KB
MD5e7bc32c5aacd0aa33702229f12dbb011
SHA1c4e723e7decfa47062de2c02e9f6ddb99cde5895
SHA256fb6dd7eb451de2a733023d9f72a3ef544eaee2b897747a89e0e6a9977bb69a6a
SHA51277b300639c1d0ca486fc1d3951477642dd06b74e9d327538b0d49c51667562c4088273e3a99f0e8e920ef142fb8706cc89cd98a22207425545f0f06d328c1d02
-
Filesize
168KB
MD5c1c3d2ef66ace5f1f37319280b8a25b4
SHA18c6f476d549d000c9639bc4854648313a48954e7
SHA256d8faf2cca347faede8e05ef655d260c068607d77fe4abad13f57aae0b15697de
SHA512c436271c267d7063a257dede91a2442d9f7fb4bbbd2097c11dc5a7815ccd583fe82c3e2611d002fc09fb9bfd6c4520e455623f61e5b8a9fb23d04be1fab9c18c
-
Filesize
168KB
MD526548516fa6fe465652dd230680e234c
SHA15fba5d33c0a6d80315723df2b62e1e3a0a6922b2
SHA2569293dcced7fec3252379635051b4982ada17c5ba866f6c0a987036cf219c0277
SHA512b0f168a9b223cf8555878c60853c1d45b4218b0d469545ed66e93bddea7e7c77e74b3e7c5457b9915bcc70dcfec73ac5e04f65abddf63e78ff69a87779105e2d
-
Filesize
168KB
MD5c386e10150b43e923532f8e148c41192
SHA1ea6e354d409233e5ba09fba609198945c148c300
SHA256e2810b8c94a96feb42ffbb4d3d4fe63a90ff8497a0193570731888d458bb1ad4
SHA512b6f4944144afddb595773f33a61b84859b2cf6f6f4a42fcd8b1766fab0e98a93c06b50fd51ad2e10c5cdd28e76d9b816a95a3e1982a4ec5c0b17c96483d52ea4
-
Filesize
168KB
MD53ce1a2e408a9219759b918572beb5c67
SHA1a120665d418d6f989b37836585d2f9d4564ba09a
SHA2561d52071025fe51deb23e2a122ec90a6ee504d8ddef171a9cf20d90e9d62547e1
SHA5128a7f9575c9fe2520787e8bf8a052c4650d5d861f193b4c6822ab2f8d439ddc175288d5d9d8acf5115e61a98826c67a11c603970deed742686b1bca4cb35d2979
-
Filesize
168KB
MD59923ac5d2b1f6ecde6e692fda8ab3374
SHA1320f3735c65410360669d92a23da2ad3ebfcccd8
SHA25677d4e6bf5ddb0f7680a72624e3dd183446eabae60beef6c50fcd201b36c3ce49
SHA512257e43aaad9cf9775f413321b20543807b9d6f7b97278ed3aaee60c7f97458cb20caa6d03140075112a6a8f32c3f32984c3bb5ff3bfb28268012ea30ce5a3bc1
-
Filesize
168KB
MD51adc7e1f988e683586e500d322e82f80
SHA1de093179ca0e406ddf9d163f1c1e9bc9db6e695b
SHA256f9d320666c4167129f069941f7982f54f6498a8585f4e7a48a2f8bf9f905e3b7
SHA5126144c2cfed5abb15c6913337b46da27bcff75cce7a8a83994f63bd4e12c16e29f52f00908858479584eb71133b8855c0ad034f927fa97f6dd927d392ebe90275
-
Filesize
168KB
MD5d41891013b293187ca4a1d2b6bf1e038
SHA1397848b460ca608cbead8ce4e163891be18c7d15
SHA256036c61ff2a91ed05c48b5d11da2acda6d1b4fa27a481bb64eed0fb780078c254
SHA5121c95c699939731ad2b7f5e99c076f260e8030f52695984fdacb57d5c19b2843a676e057f6ca5ce83600cd6cf461c78d888508a26acdb7756b27cd32e1d2f8ea6
-
Filesize
168KB
MD5f3432d7d6dbc93a815c157013f00cc0a
SHA11bd5471672b6c6d35c272c47214b2a3765361f71
SHA2561df3c103b91fc3029032d06bb40aad64928cea61d3d72f46497bc5f6a1df1180
SHA5125d5b682df5934ba528f00c90fba5c8d2a801c42f89a19a3c991f454b5b1e932f3ceef2452d728435e7cfb86874c14c81ae53e18dd149ea9f00b52ecb91a0b5e6