Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07/08/2024, 14:01
General
-
Target
2024-08-07_2ae9b11857c6480bcb0a2a9eace2457b_goldeneye.exe
-
Size
192KB
-
MD5
2ae9b11857c6480bcb0a2a9eace2457b
-
SHA1
185b1cd59a5eb3d0463a4b9380d8e52df3c93705
-
SHA256
a17e3734052e4d62b38e0376b77b71ff2e4fa643690591f5c19397980c3f443d
-
SHA512
e4620fb362b653af7e7fea5e6c415b36b10e36f098b996e1dbd8beefcd15e562bdb9fbc179e576425327a69ae95d5f97f69473d00ff573015df80a861d8a5968
-
SSDEEP
1536:1EGh0oGl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oGl1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-07_2ae9b11857c6480bcb0a2a9eace2457b_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-07_2ae9b11857c6480bcb0a2a9eace2457b_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A688A446-EE98-48b8-B8F3-7FD94960461A}.exeC:\Windows\{A688A446-EE98-48b8-B8F3-7FD94960461A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{01B804CA-DB69-474b-AF4F-A9DE1EA5EE46}.exeC:\Windows\{01B804CA-DB69-474b-AF4F-A9DE1EA5EE46}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2CA12206-7097-467f-BB88-FE5494EBBE71}.exeC:\Windows\{2CA12206-7097-467f-BB88-FE5494EBBE71}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E5BE3102-4CF9-443e-B00B-33F5DF79A764}.exeC:\Windows\{E5BE3102-4CF9-443e-B00B-33F5DF79A764}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E5429366-2257-4172-9397-D7413C7240B2}.exeC:\Windows\{E5429366-2257-4172-9397-D7413C7240B2}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86C5C632-2F4B-4c19-8FA9-85DADE3C308D}.exeC:\Windows\{86C5C632-2F4B-4c19-8FA9-85DADE3C308D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5F0873D-9485-40cf-BD1E-E36433BDBDBD}.exeC:\Windows\{A5F0873D-9485-40cf-BD1E-E36433BDBDBD}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D72D8D54-0D61-45e9-BC70-AAB76BC7B44A}.exeC:\Windows\{D72D8D54-0D61-45e9-BC70-AAB76BC7B44A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1000AB95-1A9D-450f-94CD-5A87B0B86AC2}.exeC:\Windows\{1000AB95-1A9D-450f-94CD-5A87B0B86AC2}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1947B64-DCDB-4d2e-AE5D-A009019226BC}.exeC:\Windows\{A1947B64-DCDB-4d2e-AE5D-A009019226BC}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B0627A4B-1232-48ad-891C-E54D94A6CFA9}.exeC:\Windows\{B0627A4B-1232-48ad-891C-E54D94A6CFA9}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{CE72A6E4-FE97-4c72-AA4E-A01664994B0C}.exeC:\Windows\{CE72A6E4-FE97-4c72-AA4E-A01664994B0C}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B0627~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1947~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1000A~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D72D8~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5F08~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86C5C~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5429~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5BE3~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2CA12~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01B80~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A688A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5109a7e775051af137198028c80e121b5
SHA1d9ef6f96984699b4b43064d3b12cfeb085fd78c1
SHA2569f6cac31f79c476ae3ce405d6cd8a2206aa8422507a3d4ef102296805ec71282
SHA51242b1853322884d3aa39e42d1c2872bc3a57723077864f34a96269ded7cda041d5d5df5fd157aef5cbeafcbce18e72940fcc8924a52e7463353ae0bad0dd53173
-
Filesize
192KB
MD598add0b7a17cae71457c3d0249df6d82
SHA15f4b37ad639af99bf4be596375c673cf53a607d2
SHA256edf586c19a058eecc576a70585c4f538897c953a2d3680a3d9184f8c2a19dad9
SHA5127489b9b73e2a991e68def8c3888df337e72976190b0f3be9025efcc3672031cc69068d571b695b0c1459657884c975ea2d164035dde8cf903baa224d25d7bbb7
-
Filesize
192KB
MD5db2cffb32a9d8be9f999149382371629
SHA19151d376e81470849d77e946596083d09955363a
SHA256096d264421f14bbad60ae5203f1e990cbaf7d9e5ffcbe77bf4b881fd00dbde9b
SHA5122e208c79ab5a4e7a4382ae55384e493332b6542b4f48f6b05c083e3952b1b4d465a8f6ee5a7f5c78a87050fded6571d0b6833fd151cd8b5ba9375edef79090fd
-
Filesize
192KB
MD54564fd623c5bf0538b34075a5f959dc2
SHA1ba10ee5d3c26495e26219093301c7a8ac728008b
SHA2563c301e26d10b9215761e2dc5bdda72aa01c5a3a6a2da03db148287c6d83b63b4
SHA51213a46d4c09e02d695ae37efcf185aec4a865b72d68d3344b856e864d15281e76c095baa233a2da8a4f6324c488a2a2776fa60ea40a3a89cfe2bd85aa6d2f8328
-
Filesize
192KB
MD52b0d04d5cf5fa15b247a7e5a50a43a4b
SHA15d3070cceecb683f00d67810a38e1530bd5d5120
SHA2568a62b0233b4a244b9fa3720fb660555442530a04bb87b0518c972e3080a49dc3
SHA5121715926b3285a3a07c3db39d7fd35a6cd01aa4e3840c414a1788fc695b512ffc1d43f06fbfa0876d8b3ba73d4c9de8da71ad1647fec8b7a7ddac563ccdc26443
-
Filesize
192KB
MD55f3c0e4ff3ea56a836b432f329486278
SHA126c1670cfcecb2a091280c7d5ece2b8d12edcda8
SHA2561e36e679625fc77752a63d9a8186392140f99a643582aed72be5eecb705f5705
SHA51273d33024cb8e293a8f7091cbf5a5887767b1dd74dcf5b4f20a28a6a1cf03634d17e6d784c16a522b74d3b3a6f21dd3d212ec72b92642e47d88e128b403ac4467
-
Filesize
192KB
MD5feeb3a7af13be7736a39f4fa4758cdce
SHA18f22ca43ddefd13c60564ec03f9a8118f042efb8
SHA256274de81a6e6097f0d8c67f66a28fadb4e496c2a3310a0ac226d0b20a4e83a02a
SHA5120205322e3f15ae7f5ea96f7fa8606433bb3cb9f8e39cd4649c5c691c546bdfea5812860644569f86586baca9250df89853d34340f89d0fc79a039be9272069dd
-
Filesize
192KB
MD50e5cdb53cf1cdfd009d870516c5caed2
SHA1944aff91a6a45b0898616c7325e7ea104ff0b85a
SHA256915df0af58de53201ede1e9228e7c1c5d65500845cb250fed19078fb0dcf310d
SHA512e2480d5ca6fee5cdadc3e90ca874be49aa377a8441f8a88e8b425cc77affed87d00850ad7ae7a46962185881eb2b818f22a17b3b19effd95bad2330ae2467d3b
-
Filesize
192KB
MD5f1131c094bb4296db80bc0e8043e77fa
SHA18879832b43da732b84dcd74d908eb1c255fc9599
SHA2562e7302d947b1baa8ae46a4c7c984c134feb11f9904c6da4fa9329885585ae554
SHA512bf78451b32fc705eec31820605b392fe50c46d9a537ef671a80f4905b766e24ed7a42e917230282dda7bd23bf0ad8d6c9096fb695e36b07c59966e83053ab2ac
-
Filesize
192KB
MD55e66db88911fe2310403adcb8e493959
SHA1854f743e1ff3c175c6627274f81f8a684a9d599c
SHA2569d2f1c2dcfedb2d5548671628e495bf6047c9bd9f1d303de0c64e739a541ec7b
SHA5129b509fbbf0a61e962761456769e76f70eb3c66ab328e4739ea35d94cb182f32e2e887ca55e725a15182d57a1fba6cd07714ba8e72c23b0961fe0b7b3846c3272
-
Filesize
192KB
MD5bedd3f0bebf3ffc23b3234eae05c34d7
SHA159632eccb92ef196aeed289159ee0b8806cd6c2c
SHA2561855f2bc4d71a553447e97a423714913629c301084f4b8afeb10486039618ede
SHA5129f7d58679ef0b36d456f4a84ea05b37fc6ae23262e6b66500f725a4ef2df0f1052d62b58f07efd55bce5b4e12c76c06aa5c7da8400f7b98faed9663d75870e20
-
Filesize
192KB
MD5e46976300b3d5a29ed6a52ce7c4c81b1
SHA1f2e6a26db17b75deec7585e17091644275a474b7
SHA256c3256a9e5b086b62cbb1404316696668f3c082d1acd1e205908164826a56a21e
SHA51246b42272f9637b927a6db0322620d17c8875bc2f884e97a38e0e70db614823ab695b722c96137b32702f0f8d790ca4c88062420485859c72cd187df44eabc418