Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
08/07/2024, 11:27
General
-
Target
2024-07-08_0d52b6b70a0166db6b6216808c219945_goldeneye.exe
-
Size
192KB
-
MD5
0d52b6b70a0166db6b6216808c219945
-
SHA1
4963ce965b2d316d6b5cab67904c8d95175c2719
-
SHA256
9a7077497fcdddd65c002429694909a792db9b48c0a063087a619c9b81c8f40e
-
SHA512
b1a2d7a30991190441421359108b23ae595e8a9de00cdfecb4c9b97fddb21334658ba33ba2786be013c02eb4704f5cba2496ebb753ba9536902c024edc12f7e4
-
SSDEEP
1536:1EGh0o3l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o3l1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-08_0d52b6b70a0166db6b6216808c219945_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-08_0d52b6b70a0166db6b6216808c219945_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A46BF7D-E9E8-4884-93A1-AFD447A0C12A}.exeC:\Windows\{0A46BF7D-E9E8-4884-93A1-AFD447A0C12A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3324C1F4-1C25-4237-918F-F63DB57C7B96}.exeC:\Windows\{3324C1F4-1C25-4237-918F-F63DB57C7B96}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A47C6FD4-13B0-472f-B867-6E8E1E8EE9F7}.exeC:\Windows\{A47C6FD4-13B0-472f-B867-6E8E1E8EE9F7}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D1CDADF5-7D0C-4e23-8793-DCEABA86EE3B}.exeC:\Windows\{D1CDADF5-7D0C-4e23-8793-DCEABA86EE3B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3DA571AC-C010-4eb8-9409-766909BE1E7E}.exeC:\Windows\{3DA571AC-C010-4eb8-9409-766909BE1E7E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{07DA0292-C840-404e-A35F-A10E275CB80D}.exeC:\Windows\{07DA0292-C840-404e-A35F-A10E275CB80D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{80175BCC-8E98-425c-B842-881B0D0E84B0}.exeC:\Windows\{80175BCC-8E98-425c-B842-881B0D0E84B0}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7C368B50-8F84-43e5-8EB8-81D52474CC4D}.exeC:\Windows\{7C368B50-8F84-43e5-8EB8-81D52474CC4D}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C328D397-EC18-45a1-AC6D-FC249CB7250D}.exeC:\Windows\{C328D397-EC18-45a1-AC6D-FC249CB7250D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{37BE96F0-E989-4edc-B3CE-9A56E172A038}.exeC:\Windows\{37BE96F0-E989-4edc-B3CE-9A56E172A038}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{993B6027-227C-4975-B78B-5EAEFEFD9D64}.exeC:\Windows\{993B6027-227C-4975-B78B-5EAEFEFD9D64}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{0B4A7699-9408-4a68-B29B-E52E9C309811}.exeC:\Windows\{0B4A7699-9408-4a68-B29B-E52E9C309811}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{993B6~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37BE9~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C328D~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C368~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80175~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07DA0~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3DA57~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1CDA~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A47C6~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3324C~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A46B~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5f6b2da0f12674fe40baf97ef92ce0a3b
SHA1d8d02f3c695fc18d107841bf1e566526572a38cb
SHA256a084fa229746f4ee4abad7e0926c82c6cad65d409487bd0154d2b022cca23210
SHA512c5d7bf458513eeb25847999bb040bd80faafe2183531c5a9cb316bdabc649b8e0f880a3a5cc47885d1ffb373c0cd3a03cab322ad3875f61cb26d8b73c10d5d2e
-
Filesize
192KB
MD52f2eabf22aadb45b623754e8e67d7440
SHA17561f1c9a50387d6eaa3dde028048c11c377d063
SHA25610a8275e6c179ab1a9333a6b1a34693cdf58705495470d21cc92a8cfd8564a71
SHA51290545256857cf58c7246af794b383a0687af4f779b1b588188658d4ca44ac739d0e79048522eca44117417ce16363b373d82297b2ae3885b10ae73d636986b1e
-
Filesize
192KB
MD5e468ced56a999ff03a39b8c62962d62c
SHA1d045c938cc69697dc1f4dcd9cb46dd55304ba66a
SHA256029f892d90530fca614e424c96c684b0a75c785efddfba8e6f28b77611715071
SHA512b2e82f4f777f1dd2fda9d7fc6173c7e94bba8bedb650ddb5141f900304776914315b5e7a955733ac2a98f7e0e09b11011961294513257583dba894bedf27ccdc
-
Filesize
192KB
MD53dfedc8e40960bff846885ccc64cc99b
SHA1eaa778e53c8669225d30e3a465523974316dbdf8
SHA256fed241c51c37d46fa6a42619341855007336c00e35508a16b50e1b0e5e04a398
SHA512a60439d6b146f84f527fb4b59ccbbe15d9986430424f2ac2e51144b3ffed14138299a1bf010a2c76caf987a747fe5e83860fc5052f442693c238563527f5ee48
-
Filesize
192KB
MD599634e587129be8007ae2642f273652b
SHA1d126b6f53d79ff3013a730097dfeed5237fc24cf
SHA256a14c52ce31a10dae4cf08012e2ba7294f504ac625f5b467dbc158a6826d24793
SHA51201fb36914865051c46359437b2dfc90c36a409419ae795c977920ee281efcd26bb5e4a24ac5950e76ff9e7f831ec8e44da4fa254a389c1b8fb8cc87aa08eaa73
-
Filesize
192KB
MD5bf6d2447d902552a1ee3e242288b3cd0
SHA1f4869d0d612ff58be639a40b817e413a9789d850
SHA25615c7257c9926b5eb47e7b1e54a8eb346b5a175cc8c1ec4934653cb11c41af991
SHA512fe455e1745d9db96e5d183184382d7ceb479ca12417365bc482b8aeca8399967b50556321b1d513b1e054d2965fec6e9458daa6135bd3e7e863c26b9f545cf4f
-
Filesize
192KB
MD5b8eb51aa3f588c233beeb7ab31c58f80
SHA13bdf57c87961bea818fe5cef899619a1fba9be2d
SHA25640c0e76737d1ee03ec7a62d4d7dfbf839b289f73349ba0c55e1d9ad41f86f4c0
SHA5125dff2af63747f8f0dc77a17ff6a0605083da595ede67123a64bc97693fb71b5e246885117d8412b853106dad274d5730f195f336315990c33911faaf82ead7d5
-
Filesize
192KB
MD5432ca55b44e0e538f7865d2866cb7afd
SHA102cdb82ca6c2dc7de940f7e8882d63f482de9354
SHA256c5bd8a20afdf59550d9571b992033fa4d062a613a78bc6160f98f08a9c688df2
SHA512efc8943bccc3fea65dedff2de131d53ce019e758d0c641ae2786f81347a1ec30daa9b7560b9310942d64cfa2c17178a88d49910af3bada8c6f95c3d6cf7832d2
-
Filesize
192KB
MD51ad93e17f73a645cbdbc1d73844e3d2d
SHA120cbbbba8517ff1d6c786d6580ff6b94bc8ef100
SHA256292bedb84bb1296c247edec2d7696622f62c8ac732bbd49288882ec1b1a31afb
SHA512e51cefba851260fb91cea169c3f33310696903be6512b128f2fd76a8dcb58abde51af2d7bdfde85726a48b837b321e172abb72f0d9cc640d8e949f2ce331cd35
-
Filesize
192KB
MD52e89e2caf657ffd6daa8b6058dfd4698
SHA13fc3ca4fa0732ea9bc3ad7bac0607625c06c3285
SHA2565da258bfefa2651d38ee2ac7b52cd5458e810e15f28eba0f765ec4c20ea12623
SHA5122fdd8ca5e7199b2170388f98849aed781a091edf854eecd4c20116917daf871b6761de406415d6831f1a73b693453707bf147babcdf91d706e1871ad36a3e868
-
Filesize
192KB
MD54af7b5a49a83e3ca1aaaec4b7794040f
SHA19179f4186c7b1ebc55c22258af021490998c3ff9
SHA25620561e8459342baa32cf3207e0f39ed8dfcb7e3ed4defc9df8748bb092ee03d2
SHA512176da5539692b493140d9929e678c6300d0275179a1c5d95d66eedda41ee574ed2efd78cae0aa41471c42c3fde0d29fa92aa1948d597952fd345af6f704b7ce0
-
Filesize
192KB
MD513f28f05f0f5c977e7ff103a4742a348
SHA119354949b71914c4bee44b93aaaac3a765560825
SHA256fb0f769deedbb965b4a4e7a034872e872267bb7d519a5251385fff197a21aa47
SHA512e765eb564b013ec91e75b6ce6e95261e746bf9492bdec803e68a83e3c6e0d9b5dfa7c9e937a5f0e2177026fed4af271d6179eb7e1b019b6f26b9269c8131c047