Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
23/07/2024, 12:50
General
-
Target
2024-07-23_2ac8f98cf65f94bd698cdca803e6ea7c_goldeneye.exe
-
Size
408KB
-
MD5
2ac8f98cf65f94bd698cdca803e6ea7c
-
SHA1
bb043d61d39ef15db486f5aef70d9f269604fcfe
-
SHA256
b32070931fb6dcb1a68dbdf756f473dbb19ea11621a0a96981015347ddbc9d96
-
SHA512
012d3c30cf0139413d60d8e17ebd935f771556a92cb9098b842d046f48231cc7fe274628c4e5de85e59f11bbb45c9066ddc307f1a2246d9188926b05a9078bad
-
SSDEEP
3072:CEGh0oSl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG4ldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-23_2ac8f98cf65f94bd698cdca803e6ea7c_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-23_2ac8f98cf65f94bd698cdca803e6ea7c_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B6105AB-2A7D-4f35-B656-60B0A271A42A}.exeC:\Windows\{4B6105AB-2A7D-4f35-B656-60B0A271A42A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{722733AC-5248-4ff2-991C-C24395903EDF}.exeC:\Windows\{722733AC-5248-4ff2-991C-C24395903EDF}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{64223613-7D8B-4208-ACFE-052B1787FD13}.exeC:\Windows\{64223613-7D8B-4208-ACFE-052B1787FD13}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{962C9FCB-99DF-420c-8EC9-A1A422A32282}.exeC:\Windows\{962C9FCB-99DF-420c-8EC9-A1A422A32282}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F6D844C7-36FE-4fc5-9B9D-A15811748F54}.exeC:\Windows\{F6D844C7-36FE-4fc5-9B9D-A15811748F54}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A57C5C70-1BC5-4982-8980-7A29081106E9}.exeC:\Windows\{A57C5C70-1BC5-4982-8980-7A29081106E9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8FB59C3-52CC-4aa2-BF3B-540949B6394A}.exeC:\Windows\{B8FB59C3-52CC-4aa2-BF3B-540949B6394A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B3FF417-0EC7-4768-B030-386253B00E42}.exeC:\Windows\{0B3FF417-0EC7-4768-B030-386253B00E42}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE620395-DB74-4615-A07D-29260F31E28D}.exeC:\Windows\{EE620395-DB74-4615-A07D-29260F31E28D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{77BCEE9C-3B58-4148-8543-D15605EC709A}.exeC:\Windows\{77BCEE9C-3B58-4148-8543-D15605EC709A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B73267E4-3E69-427b-9211-CD2B31F0256C}.exeC:\Windows\{B73267E4-3E69-427b-9211-CD2B31F0256C}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{86304F50-D4EB-4e46-816C-84EDD20EBD98}.exeC:\Windows\{86304F50-D4EB-4e46-816C-84EDD20EBD98}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B7326~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77BCE~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE620~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B3FF~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8FB5~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A57C5~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F6D84~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{962C9~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{64223~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72273~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B610~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD53bef576b83b092fce2dc9b735f8d002e
SHA10ae638bd12ea18c182c84adadd72184a03a5824e
SHA256bb448ebff33d4fbbcb2476e4c0169bf8e3c6d7accad912ca1285d9f63a256d48
SHA512b24e868bd2a4b5b2b05090cb01d7baa369a103264d468638557c2a489571b4e61193f5c8606d8a3c2801fba1061742f4179ce6a49582ccb7c11488674e3d1fbd
-
Filesize
408KB
MD54a7fce95aa070f23315ed3fe1650f16c
SHA1a6b2ae136cf5ed0d917748b6074db6ba5f01d9f8
SHA2564d8efec3a3459dc5446facbd4bda1bd15d80de115a3c3bbdcc97847174c69b9b
SHA512a01ed6cfb8a6ad73db2cc52976bfd6d8b32f473b893af697b60fa0f2e4e4b538a6eef58acde605fc0026778512a3ad403fc993badfec0c47c8b48748c8a37015
-
Filesize
408KB
MD5f1975be86bba15a9005c3fba2dc0ccf5
SHA17d351dc9f30f5cbe48dbf5553a9b5d08883902ad
SHA2568cfb85c99f983914132e0eb237b58fbfc819016517d937564719a796d6c410d2
SHA5121722243419945d2fd18461d96b166c623ad9c11f673cc102689262fb5cddaf75c6855ff6f788ce96c2418455afc4190d29d4f92c632aeeab819f938f9bf96cf0
-
Filesize
408KB
MD55619d3a7728129d5f494dc26a9e38822
SHA128bb3bc32d938dec5e1377c64b437bdacee832de
SHA256efe7b4e21157d0a1d7458feb4f07a7e97813cfa66a6aace61e700470afabb453
SHA5129993abb1ba93bc0172f49e6e9560b7940fb479d181bec46485f5edf275407a0eb9395bd46c39873d282c3ef046216a031b285f60d63cf7aac9e4c11cb2647f49
-
Filesize
408KB
MD564474288b2e40bbbd4403fa633e41d24
SHA1a22304fcf9cbb6d15fb07d566f5eb5ac3ebe4505
SHA2563cb3cb631e690be096b07d6f059d3d25da60447065bae179741932fbf4b90d81
SHA512b1f15b933c7b7965e9e8a6d5ea10f06096a147e2337bc8e7462bae57d69d59560f1e96334ff84e35833bd2d8a2fca96aece0401ec9e644db45d086b75cea9042
-
Filesize
408KB
MD5303f35ba5c205b295d71038f85eb2c96
SHA1e7d6d4d8dd25335eb3e2f06c3c1718fb492830b5
SHA25692043db597dc6b67ed947e43193967c3765f69f825ecea122060d3d2c75984ac
SHA51274fbb339482122c105bc5ddb2a67ddc20c9c86681a6e38c0962cdf399defe75d1582b30954ff690430d154a6e5818dfa7cd8a0b72999b455aa80b5e95d939e6d
-
Filesize
408KB
MD5f5d846603cc76fa2a56a2e6335f08c75
SHA17b4e8bc0a81c531a51e1e0d8b46d8baf2a0f35fb
SHA2566d5639e7542e8532be6b43a96fb7171c2b0cba76ef4baa5f209c5f08faac3f8b
SHA51294eec2f53669ace2f1b3319be00da342b432057a4efa0044d89f7296558d73ab3763d3a36c1b51cc3201e53f756ae687ab630c91bc7b0c7d9a9312f71ae34886
-
Filesize
408KB
MD5b562eef932fb0a64960a83cef57e5f6a
SHA1fb7e6761b71d4c292296e4d1ff8c0c274332380d
SHA2565ac0129f7b7901fe84c4c3d25b7a12ff7fb90dae561a1061267bc7f7c0a76c4e
SHA512a744eb04568d6a08e04fc8c5031df91646d12ae6a80dc6367ec7380e1cee0f7d87a0be6080d77c4d3b4402ce0723c7547201f026694fd0166b1b6a38df7a19e7
-
Filesize
408KB
MD56bcd955edd0e7a3e0d06ddad9c9fda78
SHA1a328372f4acf15e4942950a5bbe40109c8e46d3f
SHA256d4d68ceea1317f400955cbf84185cf2c72f792a314b20554ec0990bc58ccd718
SHA512fcde5858370ad77314ef1f7648641292954142f30461eaec10fdc01e771316bea3268988ea83963c4b288165d898bffaaf1fa2d7db983f11c64b34904be7965b
-
Filesize
408KB
MD5940f1dfeb4e2fb54a245bb7d6d5a5fe5
SHA1c9df003fd2adc022019241624e6472ec1bb0821e
SHA256a531beca4ec6050d8da9cbe1d325f343de15bab77d6879e29f460c8b8d0a2374
SHA5121be11288d4aef5c72aa179a33928c0fa4b77b24d0246c918b4487dbc375513c3578c7e5a219711fe02b1381028f5cde78f1dd603a610942228fe2e89c53afe41
-
Filesize
408KB
MD5e8a0444bfe726c7c3b5b9f232ee20bf8
SHA15c340badbe104ad419e288ad43706eb8ffd1bb51
SHA256f5980f77c18e7fabe3b2ca26437122ad5c7b1105fe2902da5b706e7e7cf4e1f5
SHA51296c28a1b3d8f697881625ccd22a60cb962d64b6eb3f58755131cc5a414ba49969fb0146945758a8a64d21b357c16f286c3158686cb6262bb3ca778e2763485e2
-
Filesize
408KB
MD537c040b957d6284c3636c473c49fc296
SHA17fd29b049007652795917f8f28d23e82fc2c5caa
SHA256233880fd4ac4554a50534f93684ba849aabf9493e9e1a841e55102cc32556297
SHA5122ac6074599e8b91adca6453ee9a747215c6738cc4246a42025fb52a9cfcf285ef4f972901001e9b24bce5ef3141f4fb3d298d3b16654d94eafd366267444a4f2