Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
22/07/2024, 10:44
General
-
Target
2024-07-22_b392ae62ca2f3c14b2e0ea072f902a68_goldeneye.exe
-
Size
408KB
-
MD5
b392ae62ca2f3c14b2e0ea072f902a68
-
SHA1
ca788848da39e554c9451897ecfcd7d2996df779
-
SHA256
96ceb38679a816db252416022251b050b007617de3e812f0fbcd3f023e44b6ad
-
SHA512
6198f1b00992ef895d3a157595a743d07144586c379f6198c0b2fe18941085d1f745cb34a6db0603db80ea0a9b06179311ae7ae33a76cc42b93fe006a78b3e82
-
SSDEEP
3072:CEGh0o+l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGsldOe2MUVg3vTeKcAEciTBqr3jy9
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-22_b392ae62ca2f3c14b2e0ea072f902a68_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-22_b392ae62ca2f3c14b2e0ea072f902a68_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3BDD6960-BEAD-4a9b-BBA4-BB165BE8CDC9}.exeC:\Windows\{3BDD6960-BEAD-4a9b-BBA4-BB165BE8CDC9}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FE6ACC0D-3C2D-4bbc-AECF-4DB1180E0209}.exeC:\Windows\{FE6ACC0D-3C2D-4bbc-AECF-4DB1180E0209}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3B8553A-4B5E-4fe3-B7E5-C9FC61505D8A}.exeC:\Windows\{A3B8553A-4B5E-4fe3-B7E5-C9FC61505D8A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A627D2C4-9E8B-4db4-978F-09E67C3811C5}.exeC:\Windows\{A627D2C4-9E8B-4db4-978F-09E67C3811C5}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76CEF4D5-FEF7-41fc-856A-99B08D7364CA}.exeC:\Windows\{76CEF4D5-FEF7-41fc-856A-99B08D7364CA}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75CDC0E4-141C-4010-9B74-20DBA9DC5F12}.exeC:\Windows\{75CDC0E4-141C-4010-9B74-20DBA9DC5F12}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86B40CF6-1655-4881-A84F-11E0898923C1}.exeC:\Windows\{86B40CF6-1655-4881-A84F-11E0898923C1}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F1CF0A47-C3CD-477b-877A-3FB65978952A}.exeC:\Windows\{F1CF0A47-C3CD-477b-877A-3FB65978952A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6F57A726-02D7-4543-B852-436F5C433662}.exeC:\Windows\{6F57A726-02D7-4543-B852-436F5C433662}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2205485D-E374-402a-A1BC-2852F7AAC0B6}.exeC:\Windows\{2205485D-E374-402a-A1BC-2852F7AAC0B6}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{033C9352-DB9B-42c4-B048-5E8EEA4BF633}.exeC:\Windows\{033C9352-DB9B-42c4-B048-5E8EEA4BF633}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{2CDBB1CC-6301-47ea-886A-05C8E85B1ECB}.exeC:\Windows\{2CDBB1CC-6301-47ea-886A-05C8E85B1ECB}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{033C9~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{22054~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F57A~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F1CF0~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86B40~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75CDC~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76CEF~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A627D~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3B85~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE6AC~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3BDD6~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5bfa16b688a95fce505146e524604e290
SHA16adc8020f802ee577ecdba45c4e58c4ec5e6b9c8
SHA256d3de955486aff3bc054d42a682b5e1a0e250bd631e1d8e9df4c9fae713a4d710
SHA512b5b1a92154d6d2258ded4ec31634c8492304e49e8f005c2834468645ac5a0a1f4b4d215bbc9bc04b2881a32e972bb12b8db19acb3d8c98a08826acf6b61581a3
-
Filesize
408KB
MD535797ace4eef102beeee61e626a9cc74
SHA11a8eb8b5a15bedd346429eace360c16e943efa25
SHA25618fcdf84eec85fa48631518452496186b8651574eb1b74a3d32470426118d5db
SHA512e6b7b65401f7c9f5d9d8506691f3328b6bbf065dc990c27bbe041d196ba9cc933007cbea647dae22d98ed2fd57844728837ec80c7e0782338ebeade095d8e71c
-
Filesize
408KB
MD5fc3a715ea2f04f5fc8f1006191318c17
SHA102dae125ade601bb99c8a9168288493410ba47ff
SHA2563c3595757d5c4a6b5b29bb1fdbc5a1769e87ca9cd685eda2ec1eca8de1d39dc1
SHA512a0105f67ce7c9a6f18d8ea325aa1136257896ea35956a3f314476b55c2f218e77db93906cca9dd5a5a5b3a6b60ac2ff23425b4e37f4200b78e2950acd18df5c8
-
Filesize
408KB
MD53c24244e9dd6f939910b2becea8d0d46
SHA1970ba319712b687e8d212549e20a233bb3de9749
SHA256b81375f291bfdbb45ffdb02218df91cb057be71925d923673ee9a71a9a6cfc85
SHA5127e251e89f35b570e81212217a812e611ad4a0f299e3890267fdf7834bbd044768df9e3da361f9c35731f6ba2e2b9d4dc0a32b234f1b690f943cd49dbdc50c3f5
-
Filesize
408KB
MD5258ad1e83d0826c2addaefe6c6f6a8bf
SHA19524def7c5c3188ecc6142b8b61d029d8e4a5126
SHA256046d1b78039120c8867b396e12f09db658a4f90a599543a727e2968f4080c46a
SHA5129793c6d1782b1b5ed4ed1e6198e8ab831ffbe5fbf91a9c5efba6fad6b648094bfff537e6cf8a9b3c22985342ce2fcde9bb11d598bdf2d693c7edba74959562d8
-
Filesize
408KB
MD5c185759abced26a6ed3a75c4cf2cb13c
SHA145f44deec417f2e3d8e3fd7494f5ee99eb1de6aa
SHA2562f08edeb8786e1f21faef33ae62f04066df0132ea965bbb0a77cb4af5218ccd5
SHA5120ec34bfe30aef1271ebeb3d36c4c949f24692b1919117b9482c041aec7de52ce1b090f8eec6ed6fe477d9a98627284c9cf413847c7b9578ab5aae02cbb2f37ea
-
Filesize
408KB
MD5b1a43dbc425723496dfee03da66dc993
SHA12b08f7cab0ab3c1dcbf0484be7da9e8e46c2adb5
SHA2565cafaab4026e92743fba7860405538a0be543727b272ebbfa8123621be1803e2
SHA512e31f085a920df60d4463ceb3bff6cef5ed7e631b99e6aabc278b3d66f989f0f0742ccf1ad9dc3864cc851c647a2a7878169e26fa82e5f7c03e986efe69d6b33a
-
Filesize
408KB
MD5a0b654f55536fc3ae57e919e09aa35b1
SHA1c43baa2df82277d22e8cf898015496d7f537e16c
SHA256733605adf19c8c98ea3e243cbcbfbe57d2c18dbdf09848e0551db43d43be258e
SHA512c2b048d46b705e0c8fc6438be59ea841f7493196c72a8c753a428d51d24a739438842f774375009c865209d06a991d635c1d9a16c9743bb51d982f45ff1fdf2e
-
Filesize
408KB
MD55a76ae52a81f57ace097948730a87242
SHA1c9e474467211910ea58978c212682fcb3c7bcc1a
SHA256161075f8ba19970679cb1b1a0177c1091f266e41282826f424e079f8f3731814
SHA512e0da764ab10392ef10f2ed95bd1d60012ce216def84201a64b7bea2868778f697d08da113dad1d7918def6d4c8108d5ed399fe43cc3030d5cdfe8bf9bc47d092
-
Filesize
408KB
MD5d873765a354b36e926821124e6a39a2a
SHA1b65d918d27c227268a6a0787d4e3d101165ebdcc
SHA2561a2a90989591f82026c2fdc979efd9bdbd5af0d3944db08e7f99b104cb44a510
SHA5125db6dd9cb151ff56e0210f3e4615ca030325096dc66a677539328b7963c06975872faeae0c974589b6bcf5e96dc2f8cf1f92c1f7824c7d12952dd44a6388ed8b
-
Filesize
408KB
MD5ab876badc9c1bf47988636f4acf89a38
SHA1039b3e6cf5d85f8ae1690c62dfb15723a8f97739
SHA256243094946fc86d06e760d9d2f9b697fa2ad63d88651c4ff648bef4738fe1e480
SHA51200cd170300748f145609cf142703f054f09e2d8938041ec67a4708523c9ec924111d9dbc83605f79fe9fb9d20146ae08f4f5c41006f2cc02bf21be603efdec2d
-
Filesize
408KB
MD5a64dec256b2f593599d9ed5b1b4f3e9d
SHA1f2e7769c2e8c7a0f24f0719a623f05e768a96af7
SHA2568a313f45f123c5944ba550fbd2c781e640e980402f01d9c68006554b1fbd5c5b
SHA512a7c1a6369d86fb637e31cf02b1909c51076a437dfb25bd1c980b57fde2e5c5eec0b889b746c432fa8d9c7eb0835220a412fb8261eb5cd2071c1a1f9568d40e04