Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22/08/2024, 05:55
General
-
Target
2024-08-22_94a59ca41ad842cec2d7a2e03cf82557_goldeneye.exe
-
Size
180KB
-
MD5
94a59ca41ad842cec2d7a2e03cf82557
-
SHA1
d98e22b91c98c6c57be8be340f77045d0a91382c
-
SHA256
0ee95dfe205f20a6baf277c2a2074453f04e6160f6831a73eaf17b6d9cbe4844
-
SHA512
0b49d7e2d1a153ece81a44f561690668f549f4e2ff09e56308fc64f0e9bc4db6d15089f2f4ecea2e175e449f2d2f385fd541ab586beb48441082761520ae48e2
-
SSDEEP
3072:jEGh0omlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGwl5eKcAEc
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-22_94a59ca41ad842cec2d7a2e03cf82557_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-22_94a59ca41ad842cec2d7a2e03cf82557_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F60A966-3E67-4c36-A351-F54985CCD1A5}.exeC:\Windows\{7F60A966-3E67-4c36-A351-F54985CCD1A5}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A09D9046-DE2C-4a27-AE65-ADB71655E0A8}.exeC:\Windows\{A09D9046-DE2C-4a27-AE65-ADB71655E0A8}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61D80A01-59C7-4666-9CA5-0EA36BF5C320}.exeC:\Windows\{61D80A01-59C7-4666-9CA5-0EA36BF5C320}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6096CFC8-D5D5-4d42-9AA7-3CD473917B47}.exeC:\Windows\{6096CFC8-D5D5-4d42-9AA7-3CD473917B47}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D6655E63-A0E9-4291-B8F4-4C4B5B529EF8}.exeC:\Windows\{D6655E63-A0E9-4291-B8F4-4C4B5B529EF8}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7E051B53-7C6F-48d5-96CE-C0A3F5E91449}.exeC:\Windows\{7E051B53-7C6F-48d5-96CE-C0A3F5E91449}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F30559FB-AAE7-4399-BDCF-1530F352480B}.exeC:\Windows\{F30559FB-AAE7-4399-BDCF-1530F352480B}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFCF3C19-F8C6-4449-A517-8C4B8C522425}.exeC:\Windows\{AFCF3C19-F8C6-4449-A517-8C4B8C522425}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{71E3A716-EDB3-47c0-A1F2-210CBFE55398}.exeC:\Windows\{71E3A716-EDB3-47c0-A1F2-210CBFE55398}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{96D5745D-62F2-4e14-8D7A-04CC0242E6E8}.exeC:\Windows\{96D5745D-62F2-4e14-8D7A-04CC0242E6E8}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7891878D-A542-4497-BDE3-714530D96401}.exeC:\Windows\{7891878D-A542-4497-BDE3-714530D96401}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{803EA917-DCA7-4ff6-B75F-66A1CFD397CF}.exeC:\Windows\{803EA917-DCA7-4ff6-B75F-66A1CFD397CF}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78918~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96D57~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71E3A~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFCF3~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3055~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7E051~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6655~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6096C~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61D80~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A09D9~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F60A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5ad479b1e1203a7c79fffe0bb58b946af
SHA1475193058b72bfe29fd5e1d3d1fa378fcce2a2d5
SHA256fb10229efe6167d0455d383c619c2da648834dd45d4c21bffb3b8ec0e0b6b358
SHA512d50f04c3ffb9beba61b7625af1e33d5103910c64311e5a7f8531baddfd87176d4d2891b9a0f9a09a71e745a5af3b55d1f91027d0f6a936e8504d21cbe3536a7a
-
Filesize
180KB
MD5f28fac8cd4753f6ab480cb9fbdc2f7e5
SHA126e622924fc3db50649f8745073a2e9abc73de15
SHA2560e7c255881ed00b3af8be7c69ada02d2adb7ec47ee5e0e44e6c239b1b9bd85d1
SHA512e543f19b3098e897ba7720110e89bed85b5c9bb198a11912081dbfa4d225517fc3c09b9bb7dafbe2ed1f8be37783d01256e10848a0b1bf8e6c483025e3b45812
-
Filesize
180KB
MD5fcdd7a88fa8b2363f0b31fd5bb914ddf
SHA10571b5aa03569a0c4f87ad1d7c59dbbfed6d5d70
SHA2567d369527ac9fbc4ff624f963e50f568953ee77615dd56aa97620d756c4eab76c
SHA51272554f50cba056ba25c4a319d61900e3fd32151c061604963607f88bc48abe46d3e90b2b485b254af11413d3d845e12b0b5bf4c0e744310445ebf0c7d57d424a
-
Filesize
180KB
MD5478843276331da4b05c67dc3ed1f8d60
SHA1db4675d259d2feaba72d2c6ec4d4fa5fa53bcb3d
SHA25635d7432df57d7ac7640d54ec136e6e29b936c265c9b6713a769e6ee9c8fc8830
SHA5123b7a6198bb5b2a76db849a5869005591d45f340a071990efbd2b0586578897c0a07f1c3f6f7fa7212d7414f66e2f689d69752b363a60dfca5b6b26aa560ee822
-
Filesize
180KB
MD5b9a9fce61c49ca4040fa03e68b9fd07e
SHA16611e20954a63405bc5308013471211807f83c52
SHA25658d56c70ed5492d5943b7f9c7a2752747a979c4d7fef04c65ab9b14f782017c7
SHA51213884e633a594b04e4ea97c5b92aa5185347b098422fbacc0caa604eb2ea748457702e475b7e28e912b40b89893127dbf1aa91ac03cd87bc1344c53bb6666cc6
-
Filesize
180KB
MD59331ddd0aa0d63002de03d61364003db
SHA111c5d26599136700987cf69208c727ad149019d5
SHA2568befc311fd2f18acae075a202c7e5c382fb6ac71a4074fd7fdd9be9311e46063
SHA512f8f875b33474ba27c23d6e68218b578847c1815b3d5a79246baadc8d15a339808e57996caf1efd6ac936b5000b83574c1c861ae1cc0d913ab63b51d5dcc67021
-
Filesize
180KB
MD576e70c1d9b38b2912d10a5630f3dca88
SHA1e25a87d62e7c321d050f17a0f06c163959b48240
SHA256f0531e875e50cc3346d3ebc01180526da9cfdef16351042ff878b70a8ba8f29c
SHA512635eebf23e101aa61981f10cb8361f88f322923f14148dcb9cb9d87c2e22477d5bdc835fd7e3ce73243bac55f8fb36882ad08f536c857a291c1144ee0f5a0993
-
Filesize
180KB
MD50941664595d9f2662812c04491dde2e3
SHA1e1cf4ca741ceb3cb4561423ae8bf21b397080e03
SHA256e06ce83262b6fe58483f18fe47bc9da6e98b50dea5f1c02b701b00d576907c0f
SHA5121beb1eab11aa430a163baaebdd2d7ada055efedcfd9acbd83c0a363eab25cccd3a4d98d081acfe186b0bda6e851367146f5129191db58503e71ca0c53ca60677
-
Filesize
180KB
MD529a30de207441cca71a738d0604493f1
SHA15c5e18bab328d54335a6e5bd9c19d846ba389d58
SHA256d504100f7650226e33d3dd3e6db3bd10ad640e551647044aa064bc0d01cdc16e
SHA512e591436efffd1e270754c826c44bf045d7ebd26121fbeb513464ca34344c0a41bd2e5f67fc1b21806217d83ef6f028c057177921b574edd0718b78da184fd27b
-
Filesize
180KB
MD5683b521def1cf48be7b8fb4c387a23d1
SHA12311b93d121801e6094eb991673dbabb60bff21a
SHA2564a09a966560d0b61d2667c06938a92724dd09a9f79ced55ea3b8f61ecefb5320
SHA512ece27c660f6ae5e92a3e10cd9d3ee5b9db31b9ffc335da1b8b3b16e70281eb40717501c49181ac72792a2c1949d0a73bc2238f7732056b4763b7733963070194
-
Filesize
180KB
MD520aecfc4b7c2b6fe3b275d66b18361ee
SHA1087d0b92603b43a787c95c7537534d00c503463e
SHA256817193c7b647ca468ed8dc47b97845071c0bd340bab46035075f3055c37a8f6c
SHA5124358a9cfbabe544d40c92be5f904e3b51d82f18138df8d5539ae601a8d27a381a21f06bd5b477f8a243b34ab69bd9b4eaf44f98b02949f2888af54666a481a7c
-
Filesize
180KB
MD5cb4961fca4b7ff0c7ae1029c34492f2f
SHA1b4260a4e5f6b716564cecb4ef2977a0bd920d5e5
SHA256cc3a330fc9c0490de0bdbc44bd1d8bf2e9fb02c9e0f4c377165122c161a07094
SHA512563a864447c262fb26586716ee4ea9bad228ed85245d94055ba4716303a43d0d0490f85ac1371f63f4367dd0434cc49feb86f88b1d6abc9b8b9ff7aab6a2f746