Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03/07/2024, 12:01
General
-
Target
2024-07-03_975f1c7d711db0e3636490b02189b018_goldeneye.exe
-
Size
344KB
-
MD5
975f1c7d711db0e3636490b02189b018
-
SHA1
225339848712eb1d7de00806a9203950a1976c45
-
SHA256
ccd1aa4f26b33be9ebfb8b66db9190f9512c8303cebefcfde469e2774f727f51
-
SHA512
c8ed086793e54ce84266dd89ee7fc01e12750a34a8811b71eaa5400c49cbdad0a88c6a5be311891dedbbeca10fd62136174b21d321e32644cb23393d4425feba
-
SSDEEP
3072:mEGh0o5lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGTlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_975f1c7d711db0e3636490b02189b018_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_975f1c7d711db0e3636490b02189b018_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{41464CBB-E776-4d73-8203-1EA39C3EFD75}.exeC:\Windows\{41464CBB-E776-4d73-8203-1EA39C3EFD75}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{48670D49-56AF-4763-8489-1FBB59B34F69}.exeC:\Windows\{48670D49-56AF-4763-8489-1FBB59B34F69}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B942EEBF-64AF-4ca5-86E5-F4474FBA7F8E}.exeC:\Windows\{B942EEBF-64AF-4ca5-86E5-F4474FBA7F8E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5FFCDE39-45B3-40d7-ACC2-CBF98C91821D}.exeC:\Windows\{5FFCDE39-45B3-40d7-ACC2-CBF98C91821D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0C803F1A-8D70-45ba-8C88-93F079A25E98}.exeC:\Windows\{0C803F1A-8D70-45ba-8C88-93F079A25E98}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16602923-4F50-4fee-8481-491C4E6633D0}.exeC:\Windows\{16602923-4F50-4fee-8481-491C4E6633D0}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{08E8569E-B5A1-4844-88A0-95CD3C0D334A}.exeC:\Windows\{08E8569E-B5A1-4844-88A0-95CD3C0D334A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{07E3860A-3ACD-428f-A933-6EF1E4B1E920}.exeC:\Windows\{07E3860A-3ACD-428f-A933-6EF1E4B1E920}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0421E334-8B90-4930-8E2C-F86976569697}.exeC:\Windows\{0421E334-8B90-4930-8E2C-F86976569697}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CB3FDB1D-96BB-4b39-92A1-FD5B2110025C}.exeC:\Windows\{CB3FDB1D-96BB-4b39-92A1-FD5B2110025C}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0664552B-ECF2-4112-8F79-642E9F0F4F3A}.exeC:\Windows\{0664552B-ECF2-4112-8F79-642E9F0F4F3A}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{03EE76DE-B691-416c-B7D8-9625843563B0}.exeC:\Windows\{03EE76DE-B691-416c-B7D8-9625843563B0}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{06645~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB3FD~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0421E~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07E38~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08E85~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16602~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0C803~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5FFCD~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B942E~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48670~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41464~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD50183f86ef3347575a4641febf8d71659
SHA186f0e6c6a76430dd8d0a13f98be51c331e8c5b76
SHA256732ca9d5c0b8873ffda1557bcbce7df84f2b2505bfa099ae3c53bbfc71b6dfd3
SHA5123aab14796773cbd1182779a9ecf46a69b69610439432bbb4fad04e8d97ed4259d1be49c9b479dca7e4f888867a4aef39f1cad63705189c37b045ad8e04dc9032
-
Filesize
344KB
MD5fe11ce34d4149386a3036b49fa28b501
SHA1f50005a7fca534655d235c66854a65aa38c1e31d
SHA2566e8b99d4122645c2f9d323785a4c66a3c17449e0d6fc0f43a51a671123eab59b
SHA512aadf1bf46e97062a4449775babafd0496fa6831b539ea6ff6bbdd93e98e7e24c4885ac26b03b3cdb3e2919cd0387246bcf813b9c6590c8a39d3c2888ea3ffbc3
-
Filesize
344KB
MD5391146487e6a51e4b622b104326396be
SHA15ed8f5c88a9743e53c3554554195d0f5cd9f79d1
SHA2563e1c08c9f8fa753fb1b05620b3f1ba75223b779217202d7f231603672cfee122
SHA512e6acd46513a3fefed887382c04ceff6daee019bcacb410cfc4c6cab3a1e5d3879d9702df953404afceeb82b7c807cd318ba25855b9d83b9729523d983f398bee
-
Filesize
344KB
MD55385182cc11db5ec19da7718365f0bf0
SHA1a34ff2a57c78e788b17fd41ceae76de6a2d8bacc
SHA2567aa326b5854d09358df1c63c2d033d51f9551d69ce77f59fd1ee51cd481c7b1d
SHA5124f5d083d4232a27522cbb62b5f129c7818f269082845d7252dcee45cbf73b6cd8626b49789f1fda5fbdf1ec57da37b29f403313f4e544902a9ebc9fcca032910
-
Filesize
344KB
MD541ff4ca2820243a3f87954493c5bcc55
SHA10e99ee1d72938bc8b5bf87dd0d6be860254987fc
SHA256c6af34221b2f30eedf04a383e1c45f79eb1512296bb809388d5edcd3e60058b7
SHA5125c8f7b91e18c6a9021d396e4bfbb73240b404abec10768908bfc2b6d802e43eb8d6a746254ce0bba02a2fa40cb11df912fbdd2f5fa8069ea9dfe2e83d41711b0
-
Filesize
344KB
MD56e22117e684d9263a17c402114a57b30
SHA140bc9934f75f8c7324d115d83624b63ecf3c41e8
SHA2561546d5b212e15ed4e0c5dae486b7c875891be14bb7c769249aeee4a1a69f6bd0
SHA5120c6c47ca764a39b06d0cc57c4d86d1e0360947eb1dc52fb8d536362a2627d0c48309b83753f1d3fcb07da2c0e084b4d09a80c88856d94fd359297ac1aa05048a
-
Filesize
344KB
MD511e6a20582080f3bb7d531fe61632a6a
SHA10089ae8a4e6db161a67fa4f4cc39fd2ccee515ae
SHA2567f4520fe9134fa27f837295ac915033f31bd51d8ed21fa82802fa1f4da594e6d
SHA512e10575baacc0c0c3e5a3b39bb67b7c75a696413bdad6d383dece25302d458dd3e6e4956241f02b69e52b11cb75c495d110521ef55c9f4321cc87892b2cb95989
-
Filesize
344KB
MD50883ba2cad9d5a21dc78b1aed7f8d226
SHA11c40fdf29ab87ddaa51f95da104c747efe3a53c2
SHA256fe52a2d42ccf93fc7cf69d7739a1f0d366183e1d90b9fa17b9699a4fdc04e2f2
SHA512cc889311b683a2e049e291cfbea4c3d4504ad4cf3d490027d31cfb1a8ae59bad97ba8696cb32938c2ed4f6e7600f368b8d4ef64ccf15f88919d4ffd3cfcf5eb6
-
Filesize
344KB
MD5147181715c1b32e550ed58e406905dc5
SHA1ce876f87757145bdfa245b8b51dda262150e5eb2
SHA2562ef8644c529f0a36e14ac84c75f8ace7be7e1e5ab2b6257765dff4407673d5aa
SHA5129ee3b22517471f6e64d48a2ce434a90d5ac2fd156ce05140dd574ace61ffcf36defe4120d62ffeed4a8c0e8d6824663e1691c0b1b2765e75795ef48ddc4a8852
-
Filesize
344KB
MD5e9dd91ce05b186e5cf8537973661e340
SHA1887517318180a30ea3e27d7e801501819a539c34
SHA256b5df4ad7c62094b585aec962d5b9dca8295663b3365f5f8092297077d60f6c00
SHA5120f1517d24b57cf19fe4adf58f03ebbc782e03751df3a3dc1b4397b4a75888f55d66f97a2b07f080101a3f161bea0046254ba726cc41357521aecf03b18022280
-
Filesize
344KB
MD5a9fb715d68f61db272db7c7cfce729fa
SHA11aa3787097c29a871523594ff59d84c63a279b7b
SHA25686b6d47117d815eda2b8ce2c7926547c3c943043e2da633aa0f7bfacf23469ca
SHA512ae7bcb8d6d99a6a117001b482e287e5fe6b566ad8138a2c85b8ca697dfff4157f4747ec67751c36649008d13bf92a72572f3f7a6112da1a083b6ad75655a3133
-
Filesize
344KB
MD58a8beee1994f0946683180b851155805
SHA1f3b9255b9b29ad9e0e3d4831f109896c6252f3ca
SHA25690534ca5483a7ee473ddde586054fe212a1ad8a5bd81638c602cb936d3aa113e
SHA512fb2a0e48d11943ab0bc095cb17176135e5da5473c585fe1e56083d21c2d316f3ec734290e9c875e9414541482d6edf54227e3164872944ffb1f378d6bd841f7a