Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23/08/2024, 04:00
General
-
Target
2024-08-23_c75dc8f3168f6f1fcdb7e996504f2b95_goldeneye.exe
-
Size
197KB
-
MD5
c75dc8f3168f6f1fcdb7e996504f2b95
-
SHA1
74c97a0f2490f1f46704cc3de4d728676f3265a5
-
SHA256
5fe36e03fd9575ca8c3059b86f8d8ea8fc0989dfcbdf79f509188b025eaa82f4
-
SHA512
35744b0696f2edf9fb1a196459c8b8b2e4496d18a1f1ed2ee00b10e5507852b458bdc8b52d7c0b75919f7328d6134e56b97a751b5a863a153e38fa8aebba4e00
-
SSDEEP
3072:jEGh0oil+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGklEeKcAEca
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-23_c75dc8f3168f6f1fcdb7e996504f2b95_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-23_c75dc8f3168f6f1fcdb7e996504f2b95_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9FFABA61-AFF4-46bd-9045-FA8BB8FE1BA4}.exeC:\Windows\{9FFABA61-AFF4-46bd-9045-FA8BB8FE1BA4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{179B04AA-6142-40c0-809D-29798F1D4A67}.exeC:\Windows\{179B04AA-6142-40c0-809D-29798F1D4A67}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C88C1BC-A98F-4acc-B5DF-74C567971190}.exeC:\Windows\{8C88C1BC-A98F-4acc-B5DF-74C567971190}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{45115C7A-AE5B-4a9d-A3A0-9B1691B8A1F4}.exeC:\Windows\{45115C7A-AE5B-4a9d-A3A0-9B1691B8A1F4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B469BB41-10ED-47cf-9C86-BAD916638A3A}.exeC:\Windows\{B469BB41-10ED-47cf-9C86-BAD916638A3A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35C0A804-1095-4e6e-89BD-5AD6C94E1B53}.exeC:\Windows\{35C0A804-1095-4e6e-89BD-5AD6C94E1B53}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C26482B-7D0D-41bf-A157-3236681778C5}.exeC:\Windows\{1C26482B-7D0D-41bf-A157-3236681778C5}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{803B3277-F9BC-40cb-819A-A213BF8BA8CF}.exeC:\Windows\{803B3277-F9BC-40cb-819A-A213BF8BA8CF}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B255513-5276-40eb-BF2E-F4C6AFFCF70E}.exeC:\Windows\{0B255513-5276-40eb-BF2E-F4C6AFFCF70E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8E0D01A6-89B2-4064-833F-512B9D48C735}.exeC:\Windows\{8E0D01A6-89B2-4064-833F-512B9D48C735}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6801FA78-5C6B-48fa-AF38-BEAFD76D6DD3}.exeC:\Windows\{6801FA78-5C6B-48fa-AF38-BEAFD76D6DD3}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8C33A00A-E931-4aa1-A75A-781BB549DC6D}.exeC:\Windows\{8C33A00A-E931-4aa1-A75A-781BB549DC6D}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6801F~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8E0D0~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B255~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{803B3~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C264~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35C0A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B469B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{45115~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C88C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{179B0~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9FFAB~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5a7db01844bc14bedbbdb703c3df57794
SHA168d8d5f46d035fa36a6aa7ce73d38f9fc5fb4b9a
SHA2562508863e16a52a2b31a6f71d789784bfde116ba855fc89b26edf70e5b0d01588
SHA51275f3c6bb6883a8e93773f6561da3a076179bb29324c9831bf7050d1b0c51540af68a34d507246468454384f5001e6877f0dc85894e3e173d50e42f463a48a278
-
Filesize
197KB
MD50d94df70e80b6c423d0dd6da4a9efd42
SHA1df9d249f6b2c4f3ecae071f4bb7bcefd3a65bcce
SHA256f4cdfc9a414ac6812a16a0a582672c39bd23961df3d903ca4a6cc5aaf9075797
SHA5125bc45ea860713a783a625fefc24d5e8657496393df7915815d4f402ea03e35e6b65063f679c040c2c70d674cfaaf923dd913f679789a5c9d3b100bdcb22db6c2
-
Filesize
197KB
MD5c1a5bf192ea62a25dce16ac8bdde9f3d
SHA14ff42734c3de9f5eec22d55fc6b41f8e26c0a90d
SHA256619a8efe433e4202d70c50473f2da709281d94dc1bd778717c012f10b9a333dc
SHA5129e44f48807a2e7ed6485af50f58040e671783efbf965035f75801a64dba8b41505cd2a5fbf3ecdab759fe476b7934c4815cdc5e953cbe077e5d11ab6ee9b8fe8
-
Filesize
197KB
MD5bf2a3ff59c6ccc132497724f67930467
SHA143fc316d72259872da42f29c1465facd4b004c32
SHA256b130d9d7bf7c5fec55b86cc3b1d80f77d6808047a959d382a1a5a1336d46e540
SHA512ebf53c0185c5e398c8931e495f670c6a250a6409f285ebb3720529791e489575940c35a3d8156848594e950b5bb2d2615ef9c0479c19b563441565d5aec2f021
-
Filesize
197KB
MD5425c35f0d2680b2cd096e888f83c43b9
SHA12a0cadd00762f4ef9aed1f93efe47f87e881c370
SHA256074407aebba1e47e0986ea1cbc2c6b37dc93b64f8cdffe274568110f6180d2f5
SHA5121aee151b726f0911d55a6b2a5b57f8645a90a83a17993669094deebf6d96fdf30d01f5574462a92f865d99738c6bc47ae55819ad7bf41e1689912386496519c0
-
Filesize
197KB
MD527ce7a5aba8508835d4f764359f61ae7
SHA127b4ec0b47dfcac91c7223b32956fbdea5923e0d
SHA256eb9ef305c7953aad6717d8c7459d1d01704eb9659c8f939efcc71064ea5e7c42
SHA5128f0684acb495d31a5b2ca005694dd4463a411cd3193ba0d535fbb9e66ddfd40bdbc0bdf809f5381acd74808a43c1853d8d25b20683fb9200d12cd5116e0abe9d
-
Filesize
197KB
MD579dcaa8638c34ff4ac2c5a4a6e74d807
SHA1c946f58be17f6dbc4b46a336bce1e0a2333c82a2
SHA256470167099b5e2e8b01bfca8f454d8b886aba30de24fe9789fdb3e2ef70adac64
SHA512808e8818ba1e43e947c74d775051eeeee272a848093ea34e5a6e1dacf41faf0f6384c400981a825ac5afcf9a9b326a797444b1369d102260e202f76976a192d9
-
Filesize
197KB
MD599bc9ee613e17724a39bad9913c3557f
SHA196614ce754339617576aa7bce52d3267df76deae
SHA256bfc23d0c7ccd1c4d92bb3ed602321eb94ef21f3c1e38d6123ded82f15ae98305
SHA5126a050e19ff96174fe1e3158278364fef2593057e425528a3383d7b9b160e881f3b6cb92c04a0e9f89f24ddb2d64a2b016f0c7ae1553dfa7f799b1d429257de2e
-
Filesize
197KB
MD5c87b1d10890676ed869650fe1f0c51f1
SHA1c82ef77756cca2c5c56421bc27189126aec80e36
SHA2564a8d456a5bd6a7299cd9c0e0718d3db14d24af73d85c8b0b460a663e368b559e
SHA512e1d5c4999fd7fe8a6120ddfa701c20f441386213bcb8d9b6caf43697a7537adcbb0226bca96d39a835fccd4cfd09d6e9cd3025fd950682676a613768fa4cb3e0
-
Filesize
197KB
MD556ef1527b0d9ea79a4142537c171373d
SHA164465afc6a70348301072e132ed26279fab07a28
SHA2563d264673fb13134d0cc9ce56a18f0bb7b62331121bc690e5bdcf2ddc68ffa2ea
SHA5128e818d35eb13cf7b901aed326790e8d86d3704cd75801b6eff1fed55937441f1be7b6de969b3736adb04df90a1bf1db7c71b8de28c7d64428cb555fb85c5fe24
-
Filesize
197KB
MD569635b5ecc58840743fd7a3b71290631
SHA123486633aa99921456ec0a453bde2bf1f17bd9b8
SHA2568cc0ddb34676714e75dc6e303b596652022c332a6c2d7bbc0944cc03d6c19aef
SHA5126a5da4d8eba4326ad25bd0a8347810eee863d5ec31ae433d155e5d5c2c5833bf4b4a86354398733914e17a9cc4a90c0dcf02f50ecb54788375d61b3f5e29bc88
-
Filesize
197KB
MD5836281b3a1a8b03d1ba64277aebc6bc9
SHA19c251d4daee3f7f48dbfac2181b4107287572e1f
SHA256ae434278328386f1dbf9caf09090d6d3e381fc1d0913b5dbf025d1acf96ee1ce
SHA512f6f9ad69618374e05102e70ae97fc71fd656c051f01f9b4a6bef94f2afe0be4e10e66e01d74955c80f3460bd5fbc1c129ed332faa1790dcf3fb126cec7d4e7d7