Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29/08/2024, 16:30
General
-
Target
2024-08-29_73e1fe21535ab492c706b6d336ddc885_goldeneye.exe
-
Size
408KB
-
MD5
73e1fe21535ab492c706b6d336ddc885
-
SHA1
6082c186038a41021f941d86b442d1cdc1b52ccf
-
SHA256
1be252e762c372604a8143ef57fba89da58017d5322b9ac04c9eba1ef7962128
-
SHA512
e5b1296f803fd21e320c61701d670595ed9e5d35426e2c5d421d103ca66b15af3b24aa5d82ec098d69548cdb524c935aa83cd51fdccb888f644e11f6e1a3614c
-
SSDEEP
3072:CEGh0oNl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGbldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_73e1fe21535ab492c706b6d336ddc885_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_73e1fe21535ab492c706b6d336ddc885_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE9BE501-EC6B-4c98-B1E5-EA94835CD296}.exeC:\Windows\{BE9BE501-EC6B-4c98-B1E5-EA94835CD296}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2BD5C69E-DEC0-48c9-9567-1B8D60399F98}.exeC:\Windows\{2BD5C69E-DEC0-48c9-9567-1B8D60399F98}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2C05E01D-6155-4948-B665-B06317B56CFA}.exeC:\Windows\{2C05E01D-6155-4948-B665-B06317B56CFA}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E912744B-0160-4497-8F52-9E1AA7078811}.exeC:\Windows\{E912744B-0160-4497-8F52-9E1AA7078811}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD639D6B-6062-40c2-94A1-6645C20EEC2F}.exeC:\Windows\{BD639D6B-6062-40c2-94A1-6645C20EEC2F}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5171091A-ED98-4bfb-8135-9AEF7BCA753B}.exeC:\Windows\{5171091A-ED98-4bfb-8135-9AEF7BCA753B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{49FD373D-7932-4f31-8B55-C956399F6469}.exeC:\Windows\{49FD373D-7932-4f31-8B55-C956399F6469}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{33518B0B-4432-46e6-A69F-711F458A34D9}.exeC:\Windows\{33518B0B-4432-46e6-A69F-711F458A34D9}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{46B9B14E-63E5-4945-BE0D-42B77CF6249F}.exeC:\Windows\{46B9B14E-63E5-4945-BE0D-42B77CF6249F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F856D2A-EFBC-4eee-BEE9-F2EEBAFB1978}.exeC:\Windows\{0F856D2A-EFBC-4eee-BEE9-F2EEBAFB1978}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{240C16D0-622C-4080-902F-9A99889D3FE8}.exeC:\Windows\{240C16D0-622C-4080-902F-9A99889D3FE8}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{025204EE-E2B6-4084-8DDE-951A4232743E}.exeC:\Windows\{025204EE-E2B6-4084-8DDE-951A4232743E}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{240C1~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F856~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46B9B~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33518~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49FD3~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51710~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD639~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E9127~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2C05E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2BD5C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE9BE~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD56d104023d75f5041e4f1039cf5ae1331
SHA14e21b62f6be8901de486a62732afad56e006a4e1
SHA256ed65e570e2eafb3d7424b50d647d7ed3fea030dac23e0c67c1d034632055d368
SHA5129fbfb17d64c579c3a6a204c4a17fd1b2e49a2874011d099b3e7c6696c1b23bdd5d7a60f3a800642c11fad72c27776f8fd2f0773e33fdfbb459d22edf7bdc29e0
-
Filesize
408KB
MD5c196001417094e68676478ca850435d9
SHA19de0ed8885d49b48810cad9c63546ccf77864c5e
SHA256f93b7f24bc6a1b901dbdcfe650cf44d2ea420172fd1b274b68a5970eb712b5be
SHA512f71d177028e3a94674b8a4a0a911ab57be7bd8d63a1429b736c4fa26c04558e5354d8b1aa6b033e998f93dea5f3a87d71574f6bdf9ff631af0690249fee7908b
-
Filesize
408KB
MD5819840156b1aa77b0b4d99b89beceabd
SHA105f8f2f24841f0d6f8e9c7b7f2c64256d0af0893
SHA2566c07f9555e0d3b4824d9c91b6268de613295ab0bfa702cf7d272fa024c456c9d
SHA51253d27a2d147a0e4d2411c38597034c9f1d0a67084641691d7fa6bdf4c871ea8adbc0af63ae242b5d519f2c480f2f78af3e21be881dfe70fbcaad8bbcc1bbf08b
-
Filesize
408KB
MD54d6420a93403d57bdb18fadb75da92c1
SHA1e2277520a756e0b76ac116b73c1dd2542e84cce6
SHA256856f048d2244a6c60b6f62a35c0dae16f8ad2d06387428c355f40da12601f2dd
SHA51212d9c0e8f9a98e671fc309e32dbebcf21469d2513cd85484ee9d7cb27fc8574ee419c58b440f16e608076681e20ff02461dcf212fecaa5e5edbf678db5805784
-
Filesize
408KB
MD53f8afc1f09752d2983993a49ab029cf9
SHA1585f3334cf924c721515d4a36417826d0e77ace4
SHA256673f9649affce52a1e6426b282fa2407efc292cb0075cfc2b4ce4dbf049c86ba
SHA5129e9fa6300aa5f2e6a6ca4ec681a1070ddd0655c39c906a09d918d7970d74744cd6fb33e6d3b6a80a90de2a1cfc600a86d8803d7dcea00924648b0009914c1818
-
Filesize
408KB
MD529c854f11e20c34ff3ff89e7491dee14
SHA1d6c4ad1ccb50aaa5301175247f173ef8571312c3
SHA256846a9fd940f1dd8c1684f284b27ecf1145de679b687a59cb3c912ce0f6766c35
SHA512c89bd57fa7034c4fa0866e711844a4a8780f0d4d102d85406ad9c996b708a8432bd42b26c81b2948cdc70481a77aa5e3ebb65f04fd90c4e4d73fe33e1a5d4bff
-
Filesize
408KB
MD5ce0fb43469c232d6971b5914d19ea35e
SHA176dad83b7fb2a1502b6d8e2286d61ce61d63c9cf
SHA256038001aeca544681d44f47e2baa84490cbce37b6ab5512e2961f5d92e43e5b83
SHA5123084ec343d4db979b01883b4f9796e84e63c78f143b62796154c21adb15e08b1c2d967b8875cb4605ff6b7c98e7d950f487f2faa6d00aa8a4c3bf03a0e47d125
-
Filesize
408KB
MD527405222454d2240a898a485978270be
SHA1fa00e8a87e1f9060e728db636e4074d75f684b0e
SHA256dcddcda125e1c58eb3f5d9f4327e693d54adda474d78505e3757a36cf87f3b32
SHA51294389de5ebd545cfffba3154272acf0a0f5b202a37123a7dd6a01d8d3d38d0e1ba6bece98a5352f2ddc24d88987ed0f2da656fc3a78023b185008461e4147aca
-
Filesize
408KB
MD5f95916f49e746ee7f35bc247ae092846
SHA1cebe1bf961919a3bf55d88852efab549a7aca16c
SHA256a556ce2139ee1c6afedfc8cd3bb189ae0f0cac6993a990742e508ff1230bf7e7
SHA5124cb361c832e4cc50cc0795275c7730c8820859c5af4a9a340d7bfe217e938f16c1d1394d9e2c8d3fe8ad169bc773b46678fc68aa0868e4a0219ed993be795e27
-
Filesize
408KB
MD54f4ac187253e60d2976a167ff56eda16
SHA1e02c0dc837b59dc37ba6aec908e151abbc6f3038
SHA256648cd72040b6f82d3e8d0762f479c155b9be133b02db7d2bff9af25347efe36e
SHA51209d080b9d91b0b2b583e191ffd52a5339e7028f8359030dfc48e091049c83de9cf3f63311baee361d8d51836ab2ab7ca8820bae5d182cce03a6850201945e25c
-
Filesize
408KB
MD508ea72afa6136ea88774ad8662e28da4
SHA1f6858566811f2e32ac756cfee12626351def66a8
SHA256a972ad23eafc8a1094b3aabbc3a159fb891d473e0977d97a9e8b1a61f9581a29
SHA512454a9cdc6eb27d1261b537b91be8c751b65e4c66dd2423f423b8e67f2fdda6a46145c10be32e5a59bf55f85ad2e254a6e494941911b463c31930008f846c6c4a
-
Filesize
408KB
MD5f884c9bd6aa096bf9a2686afdc1ce0aa
SHA14311733d475dad2c681bc09956728127690b3d5c
SHA2560e753fcbf5c03d920c5e2b031b7f4afdca236b283b790df3a6a20a985368b72b
SHA512136c7d5d576ff6e6de161dc6368e2afc0baaf94c2fc77ac3857320a2c228366996d41e5e452696cfb9c596af17c845083111ca22236b4e2d7e52518f63e7af8f