Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
11/08/2024, 06:48
General
-
Target
2024-08-11_2dc0282bf677cb5fd6467a7a26b29f8f_goldeneye.exe
-
Size
380KB
-
MD5
2dc0282bf677cb5fd6467a7a26b29f8f
-
SHA1
851da886f6caa65fde4ee1d4043b3b37bb9aed5a
-
SHA256
9831989c706dda8a38658756e2cc79d7a0d6049b1476d9073f0ab1d7805b76e8
-
SHA512
ded17249dab0763ba79631e8234985fa1d20afe3d9895d11991b3b6a1c4a17555f6559c6e2aab3e6df408c6ceca637f5e5c370e27173780ec8ca044ed1681bef
-
SSDEEP
3072:mEGh0o2lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGYl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-11_2dc0282bf677cb5fd6467a7a26b29f8f_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-11_2dc0282bf677cb5fd6467a7a26b29f8f_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{26223755-9264-486e-9CF4-37E0A64EF8AA}.exeC:\Windows\{26223755-9264-486e-9CF4-37E0A64EF8AA}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4AF7B8F6-772F-441d-BA10-3D0B83C20DD8}.exeC:\Windows\{4AF7B8F6-772F-441d-BA10-3D0B83C20DD8}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76DA94DE-D4D6-4c89-AC22-E319C1A99427}.exeC:\Windows\{76DA94DE-D4D6-4c89-AC22-E319C1A99427}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED2B18BA-2DA9-4cc8-8D43-BBBA8673A0BC}.exeC:\Windows\{ED2B18BA-2DA9-4cc8-8D43-BBBA8673A0BC}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB72599C-2D33-400b-A84A-88E24CDF4F69}.exeC:\Windows\{DB72599C-2D33-400b-A84A-88E24CDF4F69}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{209E2043-A162-45c3-BECB-8C8B9ECFCED4}.exeC:\Windows\{209E2043-A162-45c3-BECB-8C8B9ECFCED4}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D69EBDF4-DC39-4172-94F7-94188014BD90}.exeC:\Windows\{D69EBDF4-DC39-4172-94F7-94188014BD90}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2A2AE340-B569-4a10-99A8-433A855639F8}.exeC:\Windows\{2A2AE340-B569-4a10-99A8-433A855639F8}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{735725CC-1E48-4d2b-B1C4-CB2E554CA242}.exeC:\Windows\{735725CC-1E48-4d2b-B1C4-CB2E554CA242}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D7592AAB-63F1-44cd-B8D5-A27D5014822F}.exeC:\Windows\{D7592AAB-63F1-44cd-B8D5-A27D5014822F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B9C7A3E0-9551-4a14-8CC1-2790F8BF4583}.exeC:\Windows\{B9C7A3E0-9551-4a14-8CC1-2790F8BF4583}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D7592~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73572~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2A2AE~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D69EB~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{209E2~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB725~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED2B1~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76DA9~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4AF7B~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26223~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5ef10a325ec1f22e21cc0d54a2246eef3
SHA1404c580cd11828676f6e4ca9305ca7842c5fe68f
SHA2569635b66b46d5425def548bd2c9aedf956a026f27b31aa5b43cf5e48e664243c0
SHA512cb830f07dd0842a87e15a7ba12691a74f32cd737f90417df93eb8facfc32d4817608e674aa4756f3ac5792ba3a7ae0fcf0eaef9c06992f68636eefab3244ad83
-
Filesize
380KB
MD5febc5220fd507c67180b0bd79991b991
SHA108a7a1eb84624ca9d3f69386ce9f79960415bf3f
SHA256d71decd501eb919af958f918c76f2162f54ced385a1d3d8e52f05560f8feb5f3
SHA5122f613aa7b902ee5f1bac74be7063d3d8b9db0d79c18f66bb6c3b6a4e141fc338c0be6a126de105a56af540edcd26815646a2338915f746a4893cbe33bea2c8c5
-
Filesize
380KB
MD5bfb8d9653422c17c63cbba7b00dffd88
SHA19dd087961d90ff1e0f45b409c7af01759ecb1aac
SHA2561f2ca12168f55a1bd40471cc6ddc72e878f8aec0bbf0205aaa4872f9b5fffbe1
SHA512c7d7e473acf9ac605f96806357925b0278bdf22040306fe9170ab31049cd730ccee7de41b17bbc066826c55f2e6acd495f0db056abf31b1c39c4c951d2c365b1
-
Filesize
380KB
MD55648e6a452e6e1553cee235427015122
SHA1e7b772ce7366158018603086c6cd746bd6ef7407
SHA25614a3cbfba695d2d15bce714597ef29a54c856ad860dc35b68dd411295ff4dcae
SHA51267f8d850faf3a50da865eaf6c1ca2e89e37f4e08e0a2d2ca785d45fd1bbd9a1bdb737e5df20839739ccde6780da4e359a18c0e35e1220109c0b2a7c0b83e7524
-
Filesize
380KB
MD51f963d8871a4f238b8f9a58395f7dcb6
SHA1dcca57a3cc1f5cf6ef6b0328396def4d2613cafc
SHA2563babd8f9caf2cd1d12aad4711e60c79d1ae7924504fdb44930ec741177388b0e
SHA51258d57dfa1e1a8b5dd2f2acf07114c8c97b7d8cfc390ed5fcae8e996ad5efde8df5a4f85c8318513400e4d707db6ac943550a9dc84c219e8aaf5358d6afb98ca7
-
Filesize
380KB
MD5f84962b934f9f3a943b3561eeb45bf84
SHA1c60be1de57f9a69740a0105a74b6bf065b32a64b
SHA2569670a9868b060d66f7f0146bfa56a20ca183080e64a457c9ec2b9aee1d491fc2
SHA5128c853c9e63f80e89e1f9cf5b4c1f82c46c3a9d93d88517408fc5570ead2f11662b2e5359e7627690d12e4ac88976390077c05935db7bacd4d1dbcd8d13f1ee84
-
Filesize
380KB
MD5075e821ff6d263148107226e93698063
SHA129a833d5b0920b93fcf03fde40a97edce604f210
SHA2563059e4e254e9717176de82e27ecf54f517e5346bd35af5f8faa6c4beb54b4faf
SHA51266b232db3f56a134e7f38dbb0aaee2d6e8fe7b58e6cf28a8e569c4954396f5793b801b52e3fe7a2eb19e1b62fe034a1015c32b5f87672aa8ae488c1ab90f8db6
-
Filesize
380KB
MD54daea8d21d926c1fbef262ccc64e541a
SHA1226ca0039449f471bc88d7bae38b54f7f9285bfa
SHA256d73c1d72724f83a699abef622a3d00ff5b1159e9e338037a7540deac4fe78710
SHA5122dccd9b23cff76fd0469bfcb3cc59f063e4404bd69ae5dc45f4935fe7014f9d69391f03001babf1994f04bba6c5d80e7f11df82f0498870f225ec8b1034bf4ee
-
Filesize
380KB
MD57a8426fa8dcb9127fe13848faa7f6ad4
SHA10e64b57b06e8f3bae123b1b552f46d5460a2a96a
SHA2566749d072e2e6472bbc13838ac232a42fdbba0ce81fd66c5a03e81f384ed05c89
SHA5122c806fde15d19f53b00d3a3cc5c9d9a98b8e059f27db7cd581c20e505213e5fcceecdba027afab5d7c8bb9cd60668267f886625a3f7a409c56ab487974ebcc47
-
Filesize
380KB
MD553d8da3e969e18c38aa4b0d9377efb50
SHA172f36f1b2edaa5f243f67d6eb627324a902c073f
SHA25662155c1650c25afaccf043633296f6e8f82ff555563d6531d567148b63da734d
SHA5125350259cec925a092190d81a04647e8c4eb0720affb50e98357d01926ac6c3844e76c0631b1ff89ccbdd5f4251ef0b91b76495230bb39cf1b379603290b3f34a
-
Filesize
380KB
MD5b5bd4fb80b513d887f9d3fa1f53b970e
SHA1c0c9e0a19ca3f0c93916dde6ef8748f53c44dc97
SHA256cb4c8663ea6b5de58f3e589efd1c206e5e4b21d7d0b5349d6dd3b8471db019c0
SHA51240f7d11093df4d0d5755db1a42a3b8e1d54018edd2f65b66775e052d110130126f7ab349b81494517f1dcb66355fed1e285da9f4c535d7561d5fbf9f607561b5