Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
04/07/2024, 09:48
General
-
Target
2024-07-04_7ecbcbdc0671945868a4ee73fea64f70_goldeneye.exe
-
Size
180KB
-
MD5
7ecbcbdc0671945868a4ee73fea64f70
-
SHA1
18a4e924bd64afbc0bf01e05ea453d7be971d197
-
SHA256
39c14c550ac2c65502f4ed3bee54d3231ead3eb63e70dcc739f7439912df4b36
-
SHA512
3e16a336aa4bdf4e53e29a894391ca7ac254d5f6d348cb91dad7b9724fc354506a5e29220d5786bdb71a3d42fe2d023435d9d9bd0f48731ecda11bfa18a68458
-
SSDEEP
3072:jEGh0o/lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGNl5eKcAEc
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-04_7ecbcbdc0671945868a4ee73fea64f70_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-04_7ecbcbdc0671945868a4ee73fea64f70_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{061A8B8D-4F21-4601-B018-07989685A4C3}.exeC:\Windows\{061A8B8D-4F21-4601-B018-07989685A4C3}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{81809BFA-BE2A-4a66-A73A-889419A4DAE2}.exeC:\Windows\{81809BFA-BE2A-4a66-A73A-889419A4DAE2}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{733F88AF-5AE4-498a-859C-D2D47B80FA08}.exeC:\Windows\{733F88AF-5AE4-498a-859C-D2D47B80FA08}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ADCCB591-2480-44ac-8D1C-D189C872CD26}.exeC:\Windows\{ADCCB591-2480-44ac-8D1C-D189C872CD26}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC1EEE88-CC01-4c47-BDB2-A82F3F516BE7}.exeC:\Windows\{EC1EEE88-CC01-4c47-BDB2-A82F3F516BE7}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{707BF501-9671-44e1-A18D-102CD12EE4CB}.exeC:\Windows\{707BF501-9671-44e1-A18D-102CD12EE4CB}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB2B70CE-6422-4c95-A628-1AC977323781}.exeC:\Windows\{FB2B70CE-6422-4c95-A628-1AC977323781}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2BFECAA1-C233-4045-89EC-85C7B3613BB6}.exeC:\Windows\{2BFECAA1-C233-4045-89EC-85C7B3613BB6}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{31475DBD-8A5A-4be8-B790-6E1B8614889F}.exeC:\Windows\{31475DBD-8A5A-4be8-B790-6E1B8614889F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{705FD2C7-944D-4e64-B8FA-0E93C22F5AF3}.exeC:\Windows\{705FD2C7-944D-4e64-B8FA-0E93C22F5AF3}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{33B27E7E-C4EB-43c2-9023-8A08C4142819}.exeC:\Windows\{33B27E7E-C4EB-43c2-9023-8A08C4142819}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{88E400F2-6EB9-471f-B77D-DBD5734DDA5C}.exeC:\Windows\{88E400F2-6EB9-471f-B77D-DBD5734DDA5C}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33B27~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{705FD~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31475~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2BFEC~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB2B7~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{707BF~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC1EE~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ADCCB~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{733F8~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81809~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{061A8~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4248,i,17325488789339133686,9539570259395798500,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD54c1f18ff401fa32440191422006cc3b5
SHA1023c974b3e60f23d6c3bb8a4a03bee8975a021dc
SHA2561fab4ca48bc5da0aafc59aa1416003ebe361f645def7b4d914fb7dc0e44f0691
SHA5122b4f7c48eece5b5430c36344a353387635548fc62f2ddc67a83809b5e880f28f0d4546e0948420fb40c5bdae4479111dfe20c33f4cebc530e81f38d5d1eee905
-
Filesize
180KB
MD51fdc032c93d5a5378b766c08e514930a
SHA11d694890b36738ab402357e634349ad51fd8dcbc
SHA256c617101c22674e774c6daab9b43f758fded60cda84a8e7aa1509392e327f72fc
SHA512e9549898048b461c277357998d9d3865b203f148118ec4de6012025db5bd693e02b8852c522cf9e689c8189a474f82703cd7f58c4c27d8f6c57c64064d85c97d
-
Filesize
180KB
MD560caff226ed5561b9258f14b12f8bc1f
SHA1e6cf61efa20498722e5ae53e7a58f1f9e5aafd68
SHA2567b1600d57b081a7b132d54822a8040bf53b4ba0cfdf5bad26a1a259ff2db143b
SHA5120e0d4aae0960327a440bda779e2849172ad8d7dd4adb378ab7f2c990f472dd47648f35163ee45a7e9039f641811d906dd81a6e5c2a56f06c55894bc1c43c4b75
-
Filesize
180KB
MD570f2d29cb75068b2dfcb8f911fa0ba3e
SHA1380e66fac535f043e3a26fbd38a2224867d56696
SHA256625faa3d1371e67ce32edd6d21a6eae7fd4a5618545d9a2a9e04d41e12637874
SHA51255f5267854daec2e1e64f9bf55a47ceb2909d89df9a4796393638cb76dd079b5def5a8d07b5731df8313f69148184a4ead8c1d58fe00ecf09457ae7f375a724f
-
Filesize
180KB
MD5afade4ee3102dca0a0b027d8520ffe6a
SHA1f29eb2ba0df9d573dcc03a4caa704d9a5ae43e2e
SHA256df2217a81ed8f1e098a5209b259a23aec2e8f6b1fc7234c481e3be36b10dd13a
SHA5122a623f209408891278975a062ff5004544ac9fe99a7331a8f5b7057f1788384782751c4a0c98287039691c6f884bcb6573a40b5e9f15e5fdaa0842ec733bd1ce
-
Filesize
180KB
MD5ece76406ec23985ab1e3cbf991e92ec8
SHA1cd55cfbe70c8a7dd7b27666d897c159399cc6c32
SHA256db385b089e0f6733b7876ef853d2cc4e596040b854ba7412662672e07be8fa99
SHA5124cf0a18c9ab38d064cdb30583fcddcd83e4a813edb26d4e95474a70de2c40735f098d8e8ca0c98d22cde19e40bd341cbfd8c57da0c8bc53b6ad713f5dd740527
-
Filesize
180KB
MD5530ef7dd920f1aa24bd8b14eab65728d
SHA1543330728cb5169d9084e8b8d7e17d51cdb73d1e
SHA2566dca35af128d235c4f72d4630550be8df8d3f4da9ec6cd92490bc0bfd72cb601
SHA5124a1417feac11e3e4cdbc76a521c44a5562ee4102304a7a3a34d1e06c17f54a1179ba5e08ebbaf24d955a7ebd0a179b4087b2a14ea60b89bbbfad9961a4601877
-
Filesize
180KB
MD57908eb4ee4d540ef4a168b0a4ce33d58
SHA1adff260e7e6b1ccc0631966490dadab2536356b7
SHA256eedf40879cd91c270963da27f4599ad43af777cf88440f4115c83c9664ebfd6f
SHA51241e1a5e79bcca640442aed96d6df65a6bb123d9b889e042113b0b4621d556e1f05697bec1e659b8dd576caf74859ea8c5a98948dbb9cb2484de3a9a8c502efe0
-
Filesize
180KB
MD5dd824c778be79d96932388f3b61cd251
SHA10739dac5806731b917e87ca25289225ff561caf5
SHA256807eae7f5c72b4611b3958a681f9c8eb034e57252c1056af11c147b778301402
SHA512b2dfaa7d398a435d34a0f4b2b318891d7ea4adc4b3210d124ca0e4c6dd4c49850a292d67e08b3dbc962ac3e82383160fc8ac5246bd75bf3ddd8a3d6b03da878c
-
Filesize
180KB
MD5a166e78ad75770117f498082d779987a
SHA1511483c7e3a9981fd0206208dfaf85cc00e91b19
SHA2566ea5ff8822311b89d90bfc5a40ce7ec507a26ab571a93264477e3d6028c544e1
SHA51246bfe99dd7d7f04dbc438fedf2bb0e95f9ce9fb41795f915e5f12f24c335d727f9c423db1a52d82bf8468c8ab831495428a0f7a37172717f11332f7a814b1efa
-
Filesize
180KB
MD583b9265cb41718210e8c5b8eed0bc799
SHA12a15d93fc6c77df1a03d44fb0d9e15b1a13a0010
SHA2561084b3900779172dfbdea1ca7c84293d7c5a2b294fc6d300da7c0de43e102867
SHA51299974180f8ad509ba5b51ce1dbdbcf0b2bf340acf5b379e6ff242fc75db932f4f6b9a0af1e444194b2399c3c84bda0808f953a22a1d73e55b077aeeca6abcee7
-
Filesize
180KB
MD5cc26cd45d5bfbff70e3318c058545933
SHA13ed17ea54894179cf2ffceae09be3247aff30e66
SHA256dcf0dccacfc90574e8940b3f7c9bd0fede44078278b1dd27d6dcef63606b09fa
SHA5127926b3f3ebfd959861cf5571feb04ff76802c9f4689e3ef23a350a473e4d3d350155bdf0d535845b1f268edd2b7b0253103a86d61edf475a0cb2e06394a8ec0c