Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11/08/2024, 06:48
General
-
Target
2024-08-11_2dc0282bf677cb5fd6467a7a26b29f8f_goldeneye.exe
-
Size
380KB
-
MD5
2dc0282bf677cb5fd6467a7a26b29f8f
-
SHA1
851da886f6caa65fde4ee1d4043b3b37bb9aed5a
-
SHA256
9831989c706dda8a38658756e2cc79d7a0d6049b1476d9073f0ab1d7805b76e8
-
SHA512
ded17249dab0763ba79631e8234985fa1d20afe3d9895d11991b3b6a1c4a17555f6559c6e2aab3e6df408c6ceca637f5e5c370e27173780ec8ca044ed1681bef
-
SSDEEP
3072:mEGh0o2lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGYl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-11_2dc0282bf677cb5fd6467a7a26b29f8f_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-11_2dc0282bf677cb5fd6467a7a26b29f8f_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A9A2DF41-54C6-48cf-97E2-61F5319FCAEC}.exeC:\Windows\{A9A2DF41-54C6-48cf-97E2-61F5319FCAEC}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C9A18619-3079-45d8-91E9-4DC136B6AFA9}.exeC:\Windows\{C9A18619-3079-45d8-91E9-4DC136B6AFA9}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC242352-2425-453c-B23C-600B1A1640FC}.exeC:\Windows\{CC242352-2425-453c-B23C-600B1A1640FC}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{71722749-7E22-4169-8FEC-F10E375390A9}.exeC:\Windows\{71722749-7E22-4169-8FEC-F10E375390A9}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75E70D56-573C-4781-A3B5-8BC684289554}.exeC:\Windows\{75E70D56-573C-4781-A3B5-8BC684289554}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{39806AEC-2DD4-4503-98D7-1B9514539FB9}.exeC:\Windows\{39806AEC-2DD4-4503-98D7-1B9514539FB9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{740CA52A-E0B2-4e09-BCFD-6FAF21A8EF59}.exeC:\Windows\{740CA52A-E0B2-4e09-BCFD-6FAF21A8EF59}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8CA6B31F-1AB8-4f4b-8804-82D4539EFA5A}.exeC:\Windows\{8CA6B31F-1AB8-4f4b-8804-82D4539EFA5A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2DCA2919-C6C9-4aa6-9A58-FA374BE3A118}.exeC:\Windows\{2DCA2919-C6C9-4aa6-9A58-FA374BE3A118}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3BF23255-6F71-4fe4-9AF5-385FBFEE91ED}.exeC:\Windows\{3BF23255-6F71-4fe4-9AF5-385FBFEE91ED}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BA556AC1-99AC-4f35-85E9-7175809DE862}.exeC:\Windows\{BA556AC1-99AC-4f35-85E9-7175809DE862}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{DD775686-02AA-49b7-B445-1A55EEAD18AD}.exeC:\Windows\{DD775686-02AA-49b7-B445-1A55EEAD18AD}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA556~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3BF23~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2DCA2~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8CA6B~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{740CA~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{39806~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75E70~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71722~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC242~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C9A18~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A9A2D~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5e2a50de9292af061ea2c6cb04f9817a7
SHA135c2bb3391660c5d9687c1ababb4526beabdb0bb
SHA256b46160b98a8f642af57a8b9d9450c292bdf422789a284f52ca7f4344165105ba
SHA5122c650fdb7e6ddd8d63bf4b26fb36582176dd4e6cdaabbaf8b59e7fbaa52d66e09fd0647223d2933fb14b39af9ffb1d0ffe92c73455bb65094f8ea2218c3b6aa9
-
Filesize
380KB
MD55c2e34567658d04bc97dec3dd0ab1504
SHA1ab63e1af8d675d44c210069e4340bd565e9b2d0d
SHA256b23340d2b928b067ffd3d2f1f50700919aa7a7f11f15c0dbe31c20c0a090b4f8
SHA5123f1414c7c72defeb51fdf340cf23eaa12eb7a4b1a9edaf859797178f03c0cfb1d46f53ad3b6088e6681d410662c10c8ee74015e947ee098dc09e3549fd9098fb
-
Filesize
380KB
MD5d18c29df8f3b057e33849ae2bca284d0
SHA11f47861d3c0dc5fe9f60fc1d213e174e9e9c9953
SHA25699ba630c2f6c9dff4c7f95eb890533d74364fc9efdfefd78f78f70d0df361142
SHA51253756db0d53f071d3527e4e2adf2c39c10a175cee0310d0db48574e14587c711d9c882d24e55f09903c69ac2d7990932efaaa9849be1b63297d813578dd83bed
-
Filesize
380KB
MD589e8e771f95322219b99f6cb9eda33f8
SHA1dc8f8cd58f26269345f7ce99ed6cf96dd3928f1e
SHA2561664aaadd383053a1e19190887555e7b1915125f3c39003de78faa157832aca5
SHA512397945ef73dc96af6585c0e62fce01b9dbc90103bbbaa55320b50963eb2d79b00d19cdf5f98db137d6b5bae3d7b24aab43f4f319509023426a8e445a23839d85
-
Filesize
380KB
MD5b8357cc19fca7b9b57e77eadbca1bb6f
SHA1dab9bc08076b1368cd5bdf4c91f9e75673bee939
SHA256cb04c36dc089a9a6cab7f9b245d31673fd454c9b4ad5d046fe7cf73459df60f7
SHA512a26964b2972f0f1487ef6041658c98b0941557e2cf68d069596a4d9594ae9600ea5b055e8d7869d38d60682123a1d855d3fba178f9b95c57c798d23766babae3
-
Filesize
380KB
MD5f2af7b3abbb7abe621b7d66a26421d10
SHA15aa86902f44ece2ab219bf4a4fd6cf0bb2c78de4
SHA25607d7f15e283598379e5338d48a498e739dc28b6d1b2cf0dbc22d8590416468f1
SHA5128446c797ec18e1debe69d6bb8cce7902db581400eb8c6979a2cfc981adc6f1f50c256fac897e63b3dc4bb8a8cc8aa8dbc48225957a9ef543a9d57731074f9f2f
-
Filesize
380KB
MD5744ed9d4d00e0ccb6c5d06aec98e8b3f
SHA189f6d7b36b422958cce92b4d1cc5da9d70cd1f4f
SHA2561e1f5292bec52e78dfbb4db26d2ac8be10f8ca7f073dd48f70833aebb6585d5d
SHA51244133e868ecd1ce7ca2497dae7e87cc26cf67ddcfada8e32fde4c88589ca4aacd85b56f2611ad844b1e90bb5623565dcf3c6fa73401b27cd5157cf0482fb9ce8
-
Filesize
380KB
MD5d23eff7ceeeb8ea1ea9ee0c02809669f
SHA1b03f2d79e17874a0e8c322c6d581802b1b52794f
SHA25649b7d978201351c87dba0bd3d003e1697e5c5d50481a4c001b8e22431f64fce7
SHA51218f766a9636f7e8fd66ad251e57a69f4179ccfeed43a87164f8f1ef4c90a2edf9686b7167bbc77d6b721cd857c5314d93eb24ebbee482e2a525d267648b01d51
-
Filesize
380KB
MD5a1cfc8d0c4ab2443abd8c8314ae0bfe0
SHA18f52b7941906f29efc1e07e818a58a2dc7631bca
SHA256f433efd4a4237a2210bb8127e83a5987d0cf7e4bfeb3e5a787b05d545ca3206b
SHA512ac61e1b056f0cca6dd537930cc98a691576806c11dfab033d079b80ae6013b32091dad5c7cea3d993bb61a9a5185a2587c89a4bb69abb48dd2d34a1687ed3c19
-
Filesize
380KB
MD58f5be0049ad3f2e214220117489fd6d2
SHA1319196ad00690067e8299bc4f4026d3a71eab974
SHA2566dda50a663ea06ad991fb2aff45e387005d104758a9efbd395804071e856497f
SHA51240154f5e15e1ca8f8931959ee4300c3e972c3408af2078a272004b14c2b117ceb11d5b9fda32235ba362287a066069983e81f4ce48ff169dd6b1503a2c01b102
-
Filesize
380KB
MD516a5a5f36990fe5052e0b197276d1437
SHA19553f879aa107e60e28af1db0180a415d5300551
SHA256675f5da7da6327877ded4f5734e8b930f005205f4c1ce157e3d205e3179800d5
SHA512ebc6e1be6c3ce6ca3432b23b984b2ce52f7d283a5e9c302dcf9985e3d19a2137dc2c5fd8c0bf10ab7bf9a4c69a6ade74287d81fec2ab300f3183b87b53e936cb
-
Filesize
380KB
MD5350757f5a64f5dffa5d361ee4d03efbb
SHA1cae1405aca03a1c111f6ec2fdad565dc5d3ee70b
SHA256b00733d2971fd39816ce2a68e8ee7d785660a3fb770e02124df69cf63c8b9d42
SHA512fc11ab854dcf185f1b58c79aaaaf26695847330cee2c0fc4388536d26d1e69fb0dbcacac065a4b73cdc44edc0b7d4444840e4b0ef796698bc9372671eb0e7dbe