Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05/08/2024, 10:38
General
-
Target
2024-08-05_8e05d8885ed3eccea509bc0119bb559b_goldeneye.exe
-
Size
372KB
-
MD5
8e05d8885ed3eccea509bc0119bb559b
-
SHA1
c8a5cf2e6828b25c151952acc70b4fd1a68bfb0e
-
SHA256
562b0fa87403e752d7216721bcb2f54e96fb42b061b51cdbab7defa313ec5e9b
-
SHA512
907b13e4eae0aaf9275a7928255ce810a8330d7fcac80cb5b005e4e9bf70cdbcbef9abc58913a00b371657d6a3b26174fd54ffa2d7a1f77547c80f3eede534a7
-
SSDEEP
3072:CEGh0o0lMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGqlkOe2MUVg3vTeKcAEciTBqr3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-05_8e05d8885ed3eccea509bc0119bb559b_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-05_8e05d8885ed3eccea509bc0119bb559b_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{98A53EA9-4C4A-4904-BD5E-2CF74755FFFD}.exeC:\Windows\{98A53EA9-4C4A-4904-BD5E-2CF74755FFFD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{562206DC-AD02-40fe-8643-0812902AB68C}.exeC:\Windows\{562206DC-AD02-40fe-8643-0812902AB68C}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B9DDE1A9-05BA-4850-BF20-8AF2814C94CA}.exeC:\Windows\{B9DDE1A9-05BA-4850-BF20-8AF2814C94CA}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53C12B5B-71F9-41ee-96AC-8C3FA9FF36CB}.exeC:\Windows\{53C12B5B-71F9-41ee-96AC-8C3FA9FF36CB}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{506F4170-C1FD-4053-82DC-24038810B905}.exeC:\Windows\{506F4170-C1FD-4053-82DC-24038810B905}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A13C81E6-CEBE-4b43-A37F-54401B329408}.exeC:\Windows\{A13C81E6-CEBE-4b43-A37F-54401B329408}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B837608-42B7-4d0e-9FF4-B7A85167127C}.exeC:\Windows\{0B837608-42B7-4d0e-9FF4-B7A85167127C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{36B333F6-43F6-4558-81C2-DF9780590F20}.exeC:\Windows\{36B333F6-43F6-4558-81C2-DF9780590F20}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58772494-D94C-4016-9E03-C49A19B4AACD}.exeC:\Windows\{58772494-D94C-4016-9E03-C49A19B4AACD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B9778760-D1C8-475e-A706-833F94662155}.exeC:\Windows\{B9778760-D1C8-475e-A706-833F94662155}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C37B7185-A79E-484a-A4EE-7B56B312A50B}.exeC:\Windows\{C37B7185-A79E-484a-A4EE-7B56B312A50B}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{998764EB-731B-4ea2-B681-E5A446868719}.exeC:\Windows\{998764EB-731B-4ea2-B681-E5A446868719}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C37B7~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9778~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58772~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36B33~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B837~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A13C8~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{506F4~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53C12~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9DDE~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56220~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{98A53~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD5af0aca8ae087733f39542c66e049ef08
SHA1dce4c62b642cb1280be7beb3bbd7d65ee33c8e68
SHA256583900096c5ea3066c53f76fd8cab359953935a3acfcca619765be85ed78cca5
SHA512f549a7d9ba2615a7c84da1388397d08c6d23aacd20c19a93582d136cb2027b9b7dc9dc7963572e72c096eeb34d07ee031f1b0b4b3211fd74d06a608f489529f0
-
Filesize
372KB
MD5969ee220c74dc2635e3baad903a19623
SHA155287255615062e5f51b290e8dc5110c77a3898c
SHA256d6fe15d5c0ee8b9e22b96cd0cce1fac5ef43c68f21f2a926abdcecdeff45695e
SHA512ad1b0a8e216c2e488ce8c26580079deda98e1e5de0435db7fbab65f8c155c748ca8b3adb3388b31e7784d70697fea0ccd5f908a72a7fded358e58c0cf0383df7
-
Filesize
372KB
MD5841664ff71d03ffeb5827738e9846657
SHA1f0ffec97b0532116cadb52f8f619f9dd4e282f29
SHA256545e2ab340b94a3ce5d17d649c917f21936c074f27c9516ead438608f53bf274
SHA5121d9db430b01cce13cb52063c6057c694654c0ffdfa61558953985e2cfcee17c4195871c69da23b1aaedebeeacfef500f6a89587b459ce238adabccbbd0bbd63c
-
Filesize
372KB
MD5a9df24a54ce7cd9b34918b97f866aa39
SHA1e5e0b27ee53703ccd30444b006439e00b33a1670
SHA25628c6264f9240615a6b4f0f72618121ee3766e1a876108e6cd7f3dfbf17e7e9bd
SHA5122b8c6db64302cae1191a62460f0c06d90c0ab35cceb45219a25c9dad88305f2beb2daed201b7488b60f7870d822c63d9ae7ab97e1c6f9028834a8e1699fb4fff
-
Filesize
372KB
MD5d5d6151c49414b0b2f7229f9ea96315e
SHA1622b3a3606cbbddd3a9639ee1e08384ccc31c894
SHA25674f770b44935b15c57bfb18650c3b13ad6a1db0b79e46484afe46ae610d0dcf8
SHA51216d3e66c7030f6d9555bb482e5f4bd5288ce01d61783c2531d63a5bd4a4f843f99929ae3f91d68744e9b1955470e6089ba01e8793139d5ac1b676cdeac1e6c47
-
Filesize
372KB
MD52e58df4fdf97b78aeff60a1c3f79a08a
SHA131c56e638c8fdd194aedbad05a34000fb08673d1
SHA256bf9341b9a11b414366c89bf344af8d13b067342221fc92635c2b605a79555935
SHA5121b92f26d1d405e9b404d5d62848504a27b3985b083b8b879132c78e9d50b4653baeac3f335334720959a257584069f1344e50499574f2ec2fa47223a1b2265cd
-
Filesize
372KB
MD5a947bc0a513f224a0e01bc546758c6f1
SHA1798454c5a529c47a980f8d9ae99d149fa95f10fc
SHA256573842893fbbb3163fe0b36f430f3f8cf859dd22026546f59d84ab8a31ea7e11
SHA5123a46a5b8b5d1e11087651c0c7ba53df9a30d664aba633d43f16dd2589f9ad1f6be740ef43c0a4b8c9e894420abca4a8e18e44eb5cd8a1968f8ee2a078d697049
-
Filesize
372KB
MD5162a3317dee150db73fa4dd0f26b682e
SHA1f05cff306ff3430eea6a520a1d89c86899a8f230
SHA25609624e420c8b4277bc8c0974e6c1b0dd4d2dce0350b1051a7fb0c06419624a9d
SHA512b95c20864c9916c1c258b329b1fcc862b1647000d8f62972495859bc45c3a549a07467af8fa1612555f3beb6c1ea7797375b5c0f7195e10325f3655bb0bec3ad
-
Filesize
372KB
MD582c6288efe34e225806146a41f1c0652
SHA1bc74cd2ff7a1656da5e26cab04e05ae78ffb7561
SHA256bf4887c5d7cdeb2dd1209263f1340f56173c14218a57122043f81d24a074bfe3
SHA512ae0aad7dff0e443f7322888a13fe2b18b359c8aea5ce2149216eb7661c1a297eada8fc2b75f5b9d54b99256692eda07358966129409c9a0678a2c1764b0e14dc
-
Filesize
372KB
MD5d2f20cd676f938960ffa7d75ee1a80f7
SHA11cc9250ff6494a4af02a4680486d29e8002a3bdc
SHA25660b234cf3463f4bd7a7ef120f3273855aac7e2d7c853f063579b801a3662ed0b
SHA5129facd6be2a123b0acd82d90611ce2b1bbd873f99458e319e3cb6de81408f7799dab3d944bc4625ab84f39eadc4cb386de432d790481ab47f91d6075d459a8cd6
-
Filesize
372KB
MD539f84c50a62a2883779327f19fec26c7
SHA150b83b9617d9394e494b72da10e0b2ed16c45f10
SHA256910019c5e4c7d1708f2d7caffd692b2e302cf1de2d76242ee4c10bf43c412f49
SHA51281296cee854ed2ef5b7ff5dfe2dc322f5664ad3e02383e0b5729ce59932853b0d571ec914c89dfd9c72d28cf6430fa49bd46be3a805a8efda549d931e8cdd032
-
Filesize
372KB
MD5e17b0c432e11218e38056cae0aee7138
SHA15a4cda85a4b2bf5b5ae2feb87fb64aedf589096d
SHA256acd45e105b51a25ba528d944319a45b56e642ba89425d5f313267bb47b83803e
SHA512d62ec43752a187785e464b2c0400e3ac907f637d3a75e9b5bba601e10b74c9ec39c30f48b92a65090724f710407b74f822ba7405aab6d24960b472a958255188