Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/08/2024, 09:29
General
-
Target
2024-08-20_afa194cc3c2191d2d4269bd9dd48471c_goldeneye.exe
-
Size
168KB
-
MD5
afa194cc3c2191d2d4269bd9dd48471c
-
SHA1
5ab5999d2452fc966e16d60d72343899cf4a3e9a
-
SHA256
c531a716015613bafd5c5d8d903218c30ce7871fadcbadc9e35f3ec8baec8d52
-
SHA512
a23d377f1a6bb89dc2d0a1bc47610a3e77edcfc2c549bcb7a4000cb6a6194a88921e75e7b9728c3fa150c32a66b4558f81c8122078c330832e85e54ef5e554fc
-
SSDEEP
1536:1EGh0ohlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ohlqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-20_afa194cc3c2191d2d4269bd9dd48471c_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-20_afa194cc3c2191d2d4269bd9dd48471c_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15A1C1E9-7C17-40da-9E8D-FC16654F7593}.exeC:\Windows\{15A1C1E9-7C17-40da-9E8D-FC16654F7593}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{08590093-602E-422a-8BA1-A2A60C107E0E}.exeC:\Windows\{08590093-602E-422a-8BA1-A2A60C107E0E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD9B14CB-545D-4745-BD5B-C44B8FF13E77}.exeC:\Windows\{AD9B14CB-545D-4745-BD5B-C44B8FF13E77}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CFDAEADC-40B4-4eb1-8372-F8E0A1E9A9B3}.exeC:\Windows\{CFDAEADC-40B4-4eb1-8372-F8E0A1E9A9B3}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56E0E27C-8834-4713-B952-CBBFA62F1A5C}.exeC:\Windows\{56E0E27C-8834-4713-B952-CBBFA62F1A5C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EB4E62DF-1EDA-4dd5-8EFD-E4D364C0D3D2}.exeC:\Windows\{EB4E62DF-1EDA-4dd5-8EFD-E4D364C0D3D2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F345B354-7F3E-45fe-96F1-E46AEC71B7B4}.exeC:\Windows\{F345B354-7F3E-45fe-96F1-E46AEC71B7B4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7E9CC482-98D9-47d6-A6E0-D74FDCCB6FB8}.exeC:\Windows\{7E9CC482-98D9-47d6-A6E0-D74FDCCB6FB8}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{583F6629-7800-44da-8F48-F3D0278FC03C}.exeC:\Windows\{583F6629-7800-44da-8F48-F3D0278FC03C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{52E594FB-57F3-4947-87AD-C9D6ED2E6F3F}.exeC:\Windows\{52E594FB-57F3-4947-87AD-C9D6ED2E6F3F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35D737D1-AEB9-45c2-8D8B-FA5444B4CD92}.exeC:\Windows\{35D737D1-AEB9-45c2-8D8B-FA5444B4CD92}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{5EF4D5C8-962C-4166-876D-BA8215F1836E}.exeC:\Windows\{5EF4D5C8-962C-4166-876D-BA8215F1836E}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35D73~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52E59~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{583F6~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7E9CC~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F345B~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB4E6~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56E0E~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CFDAE~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD9B1~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08590~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15A1C~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4448,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD50321feb7e7aea4dfc726b561a73ba4cb
SHA1a3840217c35f64b4eee473ccc4b4c12f257fed0f
SHA256304103be313a7cdd6958d1bd5062af66c8ceee1b85c4de4adfbede9cb2cdb5fc
SHA512e17717bbe0e926c6d6570f95ee2aa8cad1925f97f405113b92d90e380d87cefcaaa630ce7c8f639415fd1bcafcfe4ca322c3c2867df6aedca396c367ab1c1914
-
Filesize
168KB
MD557e565c93349239d23dae330adaa5302
SHA157012240c8e92913096d4b14183f0ae06d8d0dd4
SHA2567a7bb55c47a900938c038f34328d100591b6616187397b7d9a88f5839f21c08a
SHA5125bd5adb0d532f6a67e2385e6c7d939b1f91d460394c79c8ee1ef5b541ff543573547b4c7583512b4f508f9cff0dbc10f887dc73cc2418fa734d801700c9f02c4
-
Filesize
168KB
MD5e8a4a9213cdcd2bcb25cc6fd0338ba19
SHA1682f77f57b22ae12526d610629ed8735dc11f3f7
SHA25696d76b8264197a872a395cb4868e5442b0d87911df10cc09afa15fbec54ace7e
SHA51254ec3bb20739f19c306daa852384fdb2d1739a7159e675012a071e0d791a6ba021e13bf00a604fadaf24c3b1aaf109cc973860216ce9aa364b4857b839d5e45e
-
Filesize
168KB
MD584268d4e514f368228c043b30909dbf1
SHA12aeca80c203ea7e4c8c93b8ee806cd0cf4394a2f
SHA256661657abbdf3750ee4e1849e86e3941f7a5435805ebcd7ef1aa04e0fe56c6579
SHA5120a2e9545733b18b1c0063e08f5d034bbb60975ca87ba0c18989d7f866712f0677783e788eb58f276d35f2acb167ca6f738edfa4a290f9ad519af25e75763d745
-
Filesize
168KB
MD5592a93631ff0c056c8f00d717ff49b61
SHA1d08c1a3dca3604387f3609b290a46060e784ea28
SHA256ae3a1b786518d24728d6663b20b1188775e26ca40505bb58e74cf61fdb0030d9
SHA512e95c84fc67754210797aac16233a0bbd8272ee7a61fea2f0c377a38c00074df29d2df5b01bd659f24e4358b78f4c48e247e753bf217be6a6e830e835ce259c23
-
Filesize
168KB
MD5cea97f164381982d53ed4a5e6d45cd71
SHA1b65308867309a54e7b99de40ff0d96ce78f9be29
SHA25628f1ae75fec54b2e5bd5489d579c920d77d915bc19a71cd9fbf2eed71c9460cd
SHA51239fe8d9855429e8db1e1c84cde81947364d03e68e9770b18eec81919b5d427ae5502dd548ca216df76d0f0b9dd762763b42698323b9dd41fa4e7d9b4c71cc21c
-
Filesize
168KB
MD5c43cdec0447478b03625481826101905
SHA12a7860065a245082dff0090525f39aabbfeb5fbe
SHA25693b6a207c136dfe25b6dd7fc205d2cba4af5a94b4f789644c7e71ef4b052a2b9
SHA512842c2aff275d190aece5485d51eb874008792af5e8b98003b18db87a181727a949b9ff9c0075365b919aacdc15f30d8e76ec834b84e3ac2be71f64830c2cf64b
-
Filesize
168KB
MD5bc774b4860ec776357aad596c58411e3
SHA1cae6b21f691c1e213155adeb2ae46154b1cd1664
SHA2564651e7f61635291f8931977d77e9cfbb6b29e7f9caca57c28c23ddfd5634917d
SHA5120fdc64827e7fd8d046123a48ec121f61ac5d5b85cb1a7e39045aa9a382f346f750482606380c937550274eb09a2ccb6382d5e535d1b162e48e918e845a96cb58
-
Filesize
168KB
MD592c58348ff1eaa2a8976959af2b2fd35
SHA18de2c8016f305852e901a564e2170a4d08c8219b
SHA256f54114227aa5d7dfcd292c8aae11f9499f7b8dfadd87272506763fcfcbfd211e
SHA51207b1f79308b81e8e6148c765d9d1747aebc7d10b218b48ba9e9b7ac45c144e7a9f01513d7bfab34b9dcf38a3b4a551f772d50675735cc758644167e3419b2521
-
Filesize
168KB
MD558a66faedce72c91397d5dab36fc082e
SHA10f2ce4e872fcbf694bf566d1b53da48075e2513e
SHA2562ec71ef13ee38050ebfc0755c0fe05595af892f1b630a4ffc23d32a08ec1c64f
SHA512677236bcee85c29aa1abdbb0740c2f34c1a9bae8c02b1a7ffc567fc2ec6fbbd42c69b168cf7195d192e484255df7101369577b08152ba4b67552bfc37d946d58
-
Filesize
168KB
MD564760c8786f7b2caba66f09c9173bbd5
SHA19e0bc1b6cfc28b83257aed3a0820a3e9dd85d21e
SHA256b432c227d6d75a360c88b504f9a049c9b10a6e5fa3b118e0139104e4a84826f7
SHA512afde332a8fafc6f16b786db87f992a29556b264357ae882a2c3e6fe1b3d8b58254b966d8a9ff6e112c8dcb2c61da0b6edfb9687a6c62aa3cf051332899f578b3
-
Filesize
168KB
MD5773f16d8520c847c7729d42ddeb46b00
SHA173d65a1eb94dc9729b78e8723f373dda39b0b55c
SHA2562b3a5cdb49b9c6e222a1c861563352ac882556f61cc7cd2c0cc1020c0ec1bf8e
SHA512900acbc0510e6d4cd1db7d878c99d7303b791404763cfe540b6f6c07967019ece8928cc50e7db7ea340e87aa7b8a43435a00867711de0c87412504b4fcd806d2