Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
01/07/2024, 06:25
General
-
Target
2024-07-01_7b409cd90f9134447bbc426fbf21a3b1_goldeneye.exe
-
Size
408KB
-
MD5
7b409cd90f9134447bbc426fbf21a3b1
-
SHA1
967f2aecfee3e18a9610c6b87694f823fb341456
-
SHA256
eadc633d0be3cf7c9fbac3923d31603e071e0e10c2178ce1eb327135cde4e2ca
-
SHA512
d216b325d8dfcbbee1f701fe1bae3fccad8cafc3dd8cda8f60b3bc13d60a9a61f0003bc9343dc8d2e3eb398c53576ca3ca730c832774f983598a31df79629d05
-
SSDEEP
3072:CEGh0oVl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGfldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_7b409cd90f9134447bbc426fbf21a3b1_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_7b409cd90f9134447bbc426fbf21a3b1_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C1879EA-B1DB-4ece-80AB-98110F810FA6}.exeC:\Windows\{9C1879EA-B1DB-4ece-80AB-98110F810FA6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{43ED9506-5AD2-4def-A27E-FEE599D8075D}.exeC:\Windows\{43ED9506-5AD2-4def-A27E-FEE599D8075D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75500036-75B3-4ae8-A993-40B9EEF8CBF8}.exeC:\Windows\{75500036-75B3-4ae8-A993-40B9EEF8CBF8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{65808F4D-0210-4a9e-A79C-F75432D6FA0E}.exeC:\Windows\{65808F4D-0210-4a9e-A79C-F75432D6FA0E}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8D276C98-430E-46ac-8450-A03644216C62}.exeC:\Windows\{8D276C98-430E-46ac-8450-A03644216C62}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F45F9D08-BFC4-4ae3-9DA5-84A32090C52D}.exeC:\Windows\{F45F9D08-BFC4-4ae3-9DA5-84A32090C52D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{559DBB04-B59B-4dd8-B873-E382BA26F9DC}.exeC:\Windows\{559DBB04-B59B-4dd8-B873-E382BA26F9DC}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD3B139F-4186-43b6-9F7A-10EC732795FC}.exeC:\Windows\{FD3B139F-4186-43b6-9F7A-10EC732795FC}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD0AC03C-CB6A-4410-AA76-E5D58A0D466D}.exeC:\Windows\{DD0AC03C-CB6A-4410-AA76-E5D58A0D466D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C8C79BE-1F97-49b0-913C-DC407CD892A4}.exeC:\Windows\{9C8C79BE-1F97-49b0-913C-DC407CD892A4}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A80DB355-EF1F-477c-B409-B927FFF1E199}.exeC:\Windows\{A80DB355-EF1F-477c-B409-B927FFF1E199}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{67BC002F-922E-459a-A794-D6C1498D5159}.exeC:\Windows\{67BC002F-922E-459a-A794-D6C1498D5159}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A80DB~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C8C7~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD0AC~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD3B1~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{559DB~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F45F9~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8D276~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{65808~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75500~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{43ED9~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C187~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD592160d2de5b3c11a238099744b7112f7
SHA104de88f9d42a58a5334d9f62476120fac535f533
SHA256528c7e5ae12a51d7d377258bebfc3ed9c866abc7707cfbdab9e4f7ac486179e3
SHA512e432006d03da79fad3c3c75c5326af8ef1612840cdbcfc03dc7c2dc62f2fa7e2422df2cd27f685ce0898704aea7eba5cb75dc89dd48f54944652075912f1b482
-
Filesize
408KB
MD54d5d0519d302ca9254ec0d12707bc719
SHA1df2ba0768f59f7b204a3c5f6189f3e3a725c12bf
SHA256a2d893266fe3aaf60909cf1bb51f9b558fbe468e865d6560874a4a50781e4902
SHA5128eae75d367f6f5cf52388239bee5a6d23157bb804caed00911e28a44898a71dcdafd2f554d55d55f946624313ba67666faa37f846d698870a8e2f00b8e629189
-
Filesize
408KB
MD525a7ce314129a2ba7bd01e1955e8f00a
SHA1c527704c587940b4a38d923b48ace6057d0b651d
SHA256409d3912dc4a1c9bea421b5701ea86f8734ef805d940f1535928ca59472a231a
SHA51252cb917ad3a525da312c34f12f71b72f175d151f0b92486441663257d5c4e3d11d9f354f92e900180fee923a31da6ff4217a4279af81546662d13134edf5147e
-
Filesize
408KB
MD577f276abb335a3ca436f6f7eb33f67cf
SHA18ac9ba55a6cabd0166ade45e77733ff267c7f742
SHA256be4441468437ea3d06d81ba693e66253b4e774185f0f184fc5c6348c1877664c
SHA512aace01d3d081f0f29b6e52c632caef8835810be5eab84a2b57416d1d2ac3c786a965deee5a162f670c80d5e7fe0388d062b19c35c97368c4bd57e82b0df4b498
-
Filesize
408KB
MD5e3b33bb0614251dc2c1b30d8b8ac911a
SHA1f04e930abb13bddc45f79c95dbe0e672a6751cb5
SHA25634f3220895e35a7250896c862fe5001da41388d8165f5afb4e77a29314372ace
SHA5124f9483d165f31da590377392a2c613d570543e89425ad5e4c6799cc8d5e81e5b7964474847f98673b636e95f992549d8fc92f11ebbe6fb6ed2ee7b85464d642b
-
Filesize
408KB
MD5ded0f7095a0f9c66259591ba1985fea6
SHA1be02d465d40911ed06a9b1c212344bdbd94b23c6
SHA25687ad295e45350c03737b831ce3e7b40b7891333445c39bdf050cd49e8c9da706
SHA512264eed4930e77b96de45fc6eb38a83f28ec986debee035cd9c57925ffb327fa5372b78ee821fcf2217d425d86e4bcad53239adf72d6a29392c3f6aa0b898bf94
-
Filesize
408KB
MD5209157dfb0440ba46cb05777608bd044
SHA10c72625498f1d7f3228efabcb43d660f8b9bf87a
SHA256c47c0f32ad490baa2e3e8476b588024cd4a8a913fe8a4776013a3eb1778d8928
SHA512c0f4e3c2e75de1837f164fd5870686e58d81f4af4e5100f6e31bc0d97f665c57dea7e85e228fa5458f9bb7693a663eb77bc79396351d37c2deadff781ac43423
-
Filesize
408KB
MD5cef93b6ea44335d3de79b0323cd72cb0
SHA178a079a7dcdf313b67e8dc57c6b376efb0e41816
SHA25677a78e9710d8b9d0f477c9474e6943a11cebae74fe8e408eae37caa14ac7106a
SHA512a6fdf1ffa5ae333814a14ee674c2b56640d467a438752be9d2c106dc82c7d8a9bd86c43483e19168fac791bc18faa410b78e51472a6d971ef28d3b70e459d885
-
Filesize
408KB
MD569897b3ec0f097f258bf38917ff1f6d0
SHA148309fb4169602f272580094de72f818a1b05481
SHA2560cfcfc39c6bfe3a5f9add2aceb0fc71e6beb2d63ea851902358762dcc35bb3ee
SHA51215dc92318bae2547a3eb8158feb4b4ffae6f96f862cb832516a5a15e2b4c703dc9360a3fbe54c5f2c7406d15168f59f855eae33ac8b6155c81e3f4eadd4d3b7c
-
Filesize
408KB
MD5b3d7805dd8affa09e739228584cd04a1
SHA1df97b3f21c60c0d754c48286a643705efccafafd
SHA256047c59707d0e2d6403df3b818627da92be5e79b23667ab346b9bbf2d9d861f3b
SHA5126b0fd87183f112baf1fd9b1b3de5dcde26016f1e971d8efb63e810eebeb5e7d502bcc1f0f070e8db89106e51cb956847c5348d575e39f94b1277b41f2f7f2d39
-
Filesize
408KB
MD55b06d1738cd520067feecd9efc1ce497
SHA1565e739d602846c5d0b99ab1a71ef4d324adcd22
SHA2566626f4f98e285b1d025b52be05e6361e48514b46ec9ec44acc5a74418cf94297
SHA5122b2a28a71d01b780b22b15a2ec34585757c0327da05831b30d584403bc325631a83221a7ad9ded389cb82c9da7e23249623408999ce62f0976b1690cd9fc6bd4
-
Filesize
408KB
MD57d9c0728bd6eff29705ab73fec9205ca
SHA12acde018a5cd2778a9f23acb2a9bb0538954a040
SHA256547714cb45380b3439431ed9dd48cbfe2cc7f5e4d8b03132472c52ddc9725057
SHA512d6d943f8f6f8dc4b66333417133db52f3a7b0ea401595ba325ce4ad846c95a473f81c436be32db1590b5c9e55475accfea29a01dc8346f3effe37d454b48661b