Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
06/07/2024, 12:36
General
-
Target
2024-07-06_505da9d6e8a4223951fd5b2165d98895_goldeneye.exe
-
Size
408KB
-
MD5
505da9d6e8a4223951fd5b2165d98895
-
SHA1
574aded91c55c99ab8aadd7af30db5793c593201
-
SHA256
bd5874e6e3ecd2e489ba632aff59af53f2aaa539fa458ab0db539519a4f3a225
-
SHA512
0280b0998b446c5e7344aaceefa86bf7b61c70aa8a00fd75dca2c502a269d3bff392ae224e1f1b3dac6513020f104678047fecb82d849df2695388540442349d
-
SSDEEP
3072:CEGh0oYl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGOldOe2MUVg3vTeKcAEciTBqr3jy9
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_505da9d6e8a4223951fd5b2165d98895_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_505da9d6e8a4223951fd5b2165d98895_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C1B3C708-B463-4417-A1DB-CE7071A53DB4}.exeC:\Windows\{C1B3C708-B463-4417-A1DB-CE7071A53DB4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC5A321C-59E9-4436-A0CE-9FAFEEF538CC}.exeC:\Windows\{CC5A321C-59E9-4436-A0CE-9FAFEEF538CC}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EA890534-D080-4adc-95C7-9CE81AC909A9}.exeC:\Windows\{EA890534-D080-4adc-95C7-9CE81AC909A9}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FE75FB43-5F31-4664-8A36-06E98951A623}.exeC:\Windows\{FE75FB43-5F31-4664-8A36-06E98951A623}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{239CDB82-8CD9-4e7b-8B40-6E5BF373D35B}.exeC:\Windows\{239CDB82-8CD9-4e7b-8B40-6E5BF373D35B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{762E2F10-A80D-475d-A970-1ED2107517F8}.exeC:\Windows\{762E2F10-A80D-475d-A970-1ED2107517F8}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A62327D0-F5BA-4732-B7B0-D79D35086AB9}.exeC:\Windows\{A62327D0-F5BA-4732-B7B0-D79D35086AB9}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{36EF9906-AD93-40cb-84EF-94DCB9CC4503}.exeC:\Windows\{36EF9906-AD93-40cb-84EF-94DCB9CC4503}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{32941781-8FF3-44d3-9A30-8651BBB33279}.exeC:\Windows\{32941781-8FF3-44d3-9A30-8651BBB33279}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C678885-FE32-417b-9AD2-D67D66885FDA}.exeC:\Windows\{8C678885-FE32-417b-9AD2-D67D66885FDA}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{094BDE35-0F33-4efe-82E1-B48065C4A5A7}.exeC:\Windows\{094BDE35-0F33-4efe-82E1-B48065C4A5A7}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{142A7051-74B3-47ca-8FF8-1FDAF39B13AB}.exeC:\Windows\{142A7051-74B3-47ca-8FF8-1FDAF39B13AB}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{094BD~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C678~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32941~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36EF9~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A6232~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{762E2~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{239CD~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE75F~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA890~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC5A3~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1B3C~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD54378d1b6c9e3840fa3797348d1dc70de
SHA11971188061635078308bbed5140a88ecf70dfae8
SHA256507bda294ee2a220155f11d49ca1fdfca9a3629c9fe3051ab36adddd23b6a023
SHA5129a5439c87234d930601e0e0dc9bcfbc555008d49e6f19a047ddc17f62f9ef9044c861501794969b903d44d6d39d813241b5ae64f97967014f115e0148014bff0
-
Filesize
408KB
MD51f6a3fd73295895fb80178743f2194d3
SHA1f3e14b613f0805eee459387718121d7bc6949c8a
SHA25690d7740ba36096e3dc2d9eb94b4aa1b1789a551872f82b448e407766ccad2937
SHA512d77ed5415ba631c7eeb1e4fd49e67feb1cfe801265b47ceaf8d17cdddcb8678ed77017be546453c1d0eb80275f3b9041bc86d62711b97ff1ea4e500f35c56790
-
Filesize
408KB
MD5f5cfa25cf17c008d38dbaadd5691794c
SHA1cbab194aaead03b9df595f688b6315e1dbccfc19
SHA256cda948ea21aa067be68bb07363776282c99303a73253e8ed076e2d90afd2d667
SHA512b386fc8255bf59e9195ae21184a0c124f3ae38857f1f794cd04dc3a5b54aee253a06e8f752ef5471d290d2a23e459ea297d6ea2e14e0ef52d767d38212fc3c7f
-
Filesize
408KB
MD5d99612e0f7ccf9ee3d094ae154d503cb
SHA199a5345e38ee8a598bfb037c370185072dea52ab
SHA2563e6122cced9e972622e1f5b3f457b7a2cf3197e2ae3fd4c6488a3adb3ac3d984
SHA5124093f23ef6e28360a60172c4573e679ceafe048ad447d0f23f9577d0f007dd75a35b0c8d169bd2ffc60b80cad7635919d836f441b921a5457026b9b408b10d77
-
Filesize
408KB
MD59b08308aa74a26986e110c4f47548e72
SHA1a4af16d665ff59cdd2859df9989425c11f816d10
SHA2567bedf4c9a81575824bbb1694a587cb41a6614999d141243fe6b108db451f7084
SHA51274be5beda361dcc88f922488a975a44c2c21fc8b4aeabbb364e97ec89c77a325daea4a1c2fc25af9e6899388f574109f612eb1c50983ebc8656ee422fba8c4a5
-
Filesize
408KB
MD5d00afc1512ab3f56fa683f6f30caa031
SHA1adac8c2b114c6171cf30e0e39b56813204139ed1
SHA2564821c509b6312ceb1fe7e9ac5719ac86c8048c6d2af017aba6ecd5fe572ca5ac
SHA5121b8d4a7f83baf0ca5c14138cb59c894f13f2bee88befc16d4f5fedc6eddc01a978aa4d08739ea0fdfe628df724c78454a80fa34369b44602e39be90e2ed2f874
-
Filesize
408KB
MD5db207e80343d4d84be14687cf0f64f2a
SHA148e8792a9c1bc757bb8f1a8df8365de487bfd81c
SHA25637a8bf061442aabc7d9255e5ccb9611901a19e4baba2a6a1f7e617a4782bae2e
SHA512470d653f4125d6e88854fdcb7fe8a67527abfe12f9cbbea994e2076aa05b2d80fc34c2b6068707e6e5fc538e704d8a1fea29af4d5fd6be7ec94ba2dd262ce78b
-
Filesize
408KB
MD590e3d4f56552b1ac6769f2f1a6cab2c7
SHA1afefdd7d385c588f9ebb6c000164190fd85a56f9
SHA2567fe0116841f30a8c3e8e46745060c00684dae59e2b404a21ca0f19dd61092d0d
SHA5125dc764ebbce6ad9c3c60a17e59baa1b7dd409940fc7a7bb184e035d91dabcbeb49a5e25293bbf2b8bccae82f80481bb8d0a6f531efa3a9ab7ac5730da346fafd
-
Filesize
408KB
MD5279fe2ca004d60320038ed1741544c47
SHA177816183df9dabce53dd845dc5b871d8cc86fd0f
SHA256b7ef8c09fa1470e4f16062b4c80d067043e2a42985e9ad675d1e720cd47cd604
SHA5127a256eb79232b2b4dcfc09376e8dd53d5c87ee7b742d479589f375211fdbe7a3e2db41bbc2ba850eb0344b539831397abfd8895889f9599754622f2de7f360a2
-
Filesize
408KB
MD553edcce8c01a28ba7df6e19ad16e5516
SHA17c11e9d0b4d116f6a441529eab7223f0726b0436
SHA2565101e876273d00cc197ef83edde773b4d619a3a7918b2e25f55abe0f0d3e1413
SHA512b61e0b66955b01611724abb639861fdbd92fbdd1a16b0fa14a35cbdfb5975d3d326c76b7ebb73b12efe2dfe96d23e801d3e659228cec0cb02c763324a4da4ffe
-
Filesize
408KB
MD52168677a3b3141d58baf37f41c210644
SHA1777bad13bfb2156017082cdab4c0d45dc10f801b
SHA25648e1e0ecfb46b0d1755b1138088158d559bc0f1ffec499afb08e9540e4be196c
SHA512f1bd5319761e1a797b5c019c3e97dd0d87fe269c21bf5be3ae6f3986acc7b9b11ba2b5f6ed6566fb9d9469b68eb8dbf953716343974e1103512b32bb6396b55f
-
Filesize
408KB
MD52e9af572d0ac912515db13952a6d9d0f
SHA14f2a73a7411c3cd420312be5297b7b72d40a12eb
SHA2560c946fe657071e3eda8e37769bf9038ec8f28054a2cf9a3c79f1071906b76b1b
SHA5129b1f9d993f57e12b613f0603321787550fadd572750688bc51501647c63d396592a3a55c9853d9abd102ad662b4ce902e30f0f9f41d022a9934591171b0eb70f