Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04/09/2024, 06:33
General
-
Target
2024-09-04_6b72bc43e7689fa8be7ea99be793d661_goldeneye.exe
-
Size
380KB
-
MD5
6b72bc43e7689fa8be7ea99be793d661
-
SHA1
0a4bf2738266e3cf417ae7a6703272aeb870e7ca
-
SHA256
1bec1d8d19c5967ea4f055350601566e5ee1405fe683394e9db3ac1f3bdfaaed
-
SHA512
5e6c310b55361811fc46bb5dbb90b14f9317c0ba5ff3b4b1fe956536b3630b9ea1ede1ef8f838d23a5198c8822eec1acc1010843d770ac1c201a3b7d88d2a1f9
-
SSDEEP
3072:mEGh0oslPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG2l7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-04_6b72bc43e7689fa8be7ea99be793d661_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-04_6b72bc43e7689fa8be7ea99be793d661_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{40F22A3C-51D5-4c6c-9C1E-92EB8FDF16F0}.exeC:\Windows\{40F22A3C-51D5-4c6c-9C1E-92EB8FDF16F0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{22160313-821C-4b12-A95C-22AC024DCC2D}.exeC:\Windows\{22160313-821C-4b12-A95C-22AC024DCC2D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7159F473-48C4-446b-9814-366130BFBF54}.exeC:\Windows\{7159F473-48C4-446b-9814-366130BFBF54}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{995854E7-B464-4be6-BFA7-2A49FFD8CB37}.exeC:\Windows\{995854E7-B464-4be6-BFA7-2A49FFD8CB37}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93624884-69D9-4a92-B1DF-CA524FA1130D}.exeC:\Windows\{93624884-69D9-4a92-B1DF-CA524FA1130D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B7B2C558-270E-458e-B1A7-D64EEA9566D7}.exeC:\Windows\{B7B2C558-270E-458e-B1A7-D64EEA9566D7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{760F8B6B-F74F-4adf-B8F8-843C2502A2D5}.exeC:\Windows\{760F8B6B-F74F-4adf-B8F8-843C2502A2D5}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FC19CF7F-8191-435c-B786-231CC54E564B}.exeC:\Windows\{FC19CF7F-8191-435c-B786-231CC54E564B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{29F5891A-BD35-4c0a-A9DE-6F4EAC831A6F}.exeC:\Windows\{29F5891A-BD35-4c0a-A9DE-6F4EAC831A6F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0A3FDFB-E565-4030-8439-405B545CCEB6}.exeC:\Windows\{D0A3FDFB-E565-4030-8439-405B545CCEB6}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{26D6673A-9291-4c92-BBE2-3FCAA7EF97E3}.exeC:\Windows\{26D6673A-9291-4c92-BBE2-3FCAA7EF97E3}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{96C0775E-2773-4a19-8522-F045E8E2A9E4}.exeC:\Windows\{96C0775E-2773-4a19-8522-F045E8E2A9E4}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26D66~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0A3F~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29F58~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC19C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{760F8~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B7B2C~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93624~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99585~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7159F~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{22160~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40F22~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD58c173bb89bdc4af67469867517b98919
SHA1945d9d76ebe474d799504f8d5cf1fbd5f983cc68
SHA256df2339d7dca7419a0d91ed28fdea66c168aaa5b24e0a0e4fe0eeafe04cb05c53
SHA5123ad2c1fd06945159eed7500fa08657f0a859768ab36db79ebf327fc744a3f98a523d083df50df985acec51d4de9d3ad40c7cdf56ff7f502e0ced39decc11aa00
-
Filesize
380KB
MD561fa716812c16444a1dbe93befc7707f
SHA1bcd4f37ec1a7b5b14a944f66fe0c32e2dee3df49
SHA256031b3dec46aad5400f9f32190e1a0afa75062a4d5b9285b33957a1ffb26616d9
SHA5125608d37a877332705980f0699dd7660886851276adf751c5f246fd8525a4295790f5e0a975156ce35dd3d872f39f3914c818fc10f147c8e2baf6ddf5763c12bb
-
Filesize
380KB
MD577427f563cc30b6de4bcaf44f5e88f08
SHA1b117a71b8adda2d51a083b0927e992e5ba5a7f22
SHA2563df02f37620248e9f3c54a12eeb5b4e855564e1e4d0248685dcf139d881eeade
SHA5123f9f94a83a8e2f4121ff039ec1e5e81575ab0f69aa98124d17ea1b6497105b28bdba82f0b770b3011969994c6aac07629ac91ab9482295188eeccce9da164a86
-
Filesize
380KB
MD5eb5080108857c1f0af4291e7e45ca576
SHA16d69b8273a61fc29a6bd0a08241d89c23d3b7377
SHA25641bb9ca31cd48a1551928949db4a15280294cde4b9dda1383b9ce9a39ee717cf
SHA51238ec4be73ab1015c9eb285abb5d03267958dab9586e6a62308110c2a636c3746d6a7ff04628c8af4b37cea9154290657f2e2e2484078d0d1e943143a5d8787be
-
Filesize
380KB
MD5b4e5e774b82ee962030520a70dc952ff
SHA18283382c67b9db378514769c59789807ff270381
SHA256bd336b0c4216085b67e46a3a8ebae7d56b0d702b4ed8b0d889e440dcc38984cc
SHA5128da54daa3fa9507557397d3a92f0e2ced82806483ae7fc455fed194d652a4d4d3aa89b61582cacf559d0390eee61cc09f8518171ae11259ebb003e43c19d3a5d
-
Filesize
380KB
MD5a7e2f4a95bf309b850ad51589d765a56
SHA17b5ad113ce5fb0ee417a943c9df82f0f05d779d3
SHA2568ce16939055f2b1939b2ff0be0a9dd2bdd07c36f0ece56bad050932d2ef2e029
SHA512216a1e49ed288129eda052cc7f903ef18c60bfe6cfab145bebc44588eae39aac35467dadac11e40e45479822624f56feff35d67d5b9e31c61258ec84a6c4d01e
-
Filesize
380KB
MD5b90d2b7b65d070444455eb269f3944b5
SHA1109fd46c7231c0d9c702dcbfa7d6ca356bfbe5e1
SHA25684914372ccda44addf5db24367adbd00fa91a069be568849309e07b2808d1518
SHA5123a2100fc0d88d4535a167cd8252b8a6b296c12341b73d9858322dd775cdfd190a2c30a53e2103f6f2a71cf65a4f11609dfafaa42c42b7965df9a2ae396108489
-
Filesize
380KB
MD57d80d0d96f333dd70c5b3fbd48ff586e
SHA119fcf79a6acb1ea2eb1bff2479d8c09c2dd5bf42
SHA2560bbe72b5af0110e9fc7701ea819243dc7772ffddc31f7adbd0b8cb94000f588b
SHA512b5c28d67dddd2eda0a7542b8ebae7c190935a1cf40ee72580bbcaed1e1f3b5b673a4f25088b4bea602c506c3bb7c63166ecd5fa24c2c4e7f2ef779d6e7576158
-
Filesize
380KB
MD547ba564b16faeb1a6fad1eeed9187659
SHA138307da3fcbdea9adcfbf1f976c7a07c5d9f0660
SHA25621bce52d824e22c5ee56ef933c65645c6fd80c152ab2c080b46795b426614724
SHA5121288b6d44a2305e7b784cead33060e0ba8ffc8389b571a9ba6bbda845d502ade209273aa63753f967484e8bd61b2928be22bb99b73550c92f15114ca8ab31e41
-
Filesize
380KB
MD5132bf6737da0c836410c7878615c1415
SHA1d3ada7d0d6d00f379e12b5d7e1917052893a9844
SHA256cc18f850fe8ec842304320b094cd018a84937416cc83657462a367385d94d27b
SHA5120a0a187a94f9a5521a507277ba77bb1e527a802c27b42afd46d6109d1f328d735c0cbe56c0f5f4bda920bd29426ac9537d3ea44864c7e7894eb477341fd35237
-
Filesize
380KB
MD5812c42c1943ea5d0289735cf21ded6a9
SHA1f43c7ec2a0aa8bdb4842e2edafa27fdf1426281d
SHA256b49519c57a1d0c3cb77ee294c83042e078c4a74dbd72e7701bbef03381dc93de
SHA5121c0f28ea0f7febb0c1a472e56aca6fe4ea0b7617e49d687765f3fd7db03702318efb54506cf47b2a7b7a21636ab196e0bbdc8288a20888c749cd16b38d312a84
-
Filesize
380KB
MD5e282b5620e30c1d6cc912a0efad3fd21
SHA1b37f466589e3d6adf6810ab8aef767abf9b34db6
SHA25691f3bae85c6bc8623e64ec28372906dd45aeb54fb9c1e03972e85332d03490c4
SHA51229bd99b00da6b5244a02e5bf5560e0d084d74e4eb10eace45003a3cbafeb4cdae96387b3b32a3980d5253ed6ef27e928ec295ec201ff37a0d9623ed0402ce788