Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/09/2024, 11:17
General
-
Target
2024-09-06_f142d2bee57c37de55c69e8558f89e78_goldeneye.exe
-
Size
216KB
-
MD5
f142d2bee57c37de55c69e8558f89e78
-
SHA1
a9534315143d1550ec9d1ed7f07b5808244af99e
-
SHA256
037f16a08772fd8ddc8178abcef40fb27e6082356ab8859dec17af4a5e816721
-
SHA512
4438f0116a12f5a20f69bdee3e38058c4ec46fb2f7f66515c042a55eea6b5341d14f04c1699f7d9d0b71163da12a9d27d50b935a18cef6375bfec49b5e7560c2
-
SSDEEP
3072:jEGh0o4l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGSlEeKcAEcGy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-06_f142d2bee57c37de55c69e8558f89e78_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-06_f142d2bee57c37de55c69e8558f89e78_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1B4018D9-42A5-4e83-BEEA-62EBF860E860}.exeC:\Windows\{1B4018D9-42A5-4e83-BEEA-62EBF860E860}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{155D591F-EBF0-4dea-A5BB-2B07513BB0A9}.exeC:\Windows\{155D591F-EBF0-4dea-A5BB-2B07513BB0A9}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4449F9FD-8844-4d6d-BDA3-B2ACB8DBCAB9}.exeC:\Windows\{4449F9FD-8844-4d6d-BDA3-B2ACB8DBCAB9}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8397ABDA-B9E6-43b9-831B-A665E4226F54}.exeC:\Windows\{8397ABDA-B9E6-43b9-831B-A665E4226F54}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7E2155DB-28EF-464c-B2F7-1FC50481CE70}.exeC:\Windows\{7E2155DB-28EF-464c-B2F7-1FC50481CE70}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{857C9352-1188-4411-B02F-FB4CE8C07E3C}.exeC:\Windows\{857C9352-1188-4411-B02F-FB4CE8C07E3C}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0EAAA83F-CB43-4dab-9DA7-B1628396E4F0}.exeC:\Windows\{0EAAA83F-CB43-4dab-9DA7-B1628396E4F0}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{98C880B5-07F5-48a3-B749-6122C4260883}.exeC:\Windows\{98C880B5-07F5-48a3-B749-6122C4260883}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{68FC655F-967A-4b12-BB5C-91073CFDFB3B}.exeC:\Windows\{68FC655F-967A-4b12-BB5C-91073CFDFB3B}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A9C75D81-DB27-47cf-8FE4-6825FC80D4DC}.exeC:\Windows\{A9C75D81-DB27-47cf-8FE4-6825FC80D4DC}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BF8FACD4-3AA6-4024-B3DF-D44DB053A361}.exeC:\Windows\{BF8FACD4-3AA6-4024-B3DF-D44DB053A361}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C9AB5DF3-EC32-4b0c-ACDD-AB83EEE6E9A3}.exeC:\Windows\{C9AB5DF3-EC32-4b0c-ACDD-AB83EEE6E9A3}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BF8FA~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A9C75~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{68FC6~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{98C88~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0EAAA~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{857C9~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7E215~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8397A~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4449F~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{155D5~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B401~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5f4e7e71e2a8ae623e581d1775f162883
SHA137f6cdbb72c70e5a2064706f250fd262b50a6621
SHA25676b5a680b62b7218851eb13976938988597ce820aebf5e7b4bca1e8402f4596a
SHA51208f085f30380fb20016818b2fd64d089a6b40bd1edb9da8255682f6c9fa06b38d14998f387c9ff125b7ddb1fa1bebb224b24416a6353c44ab23d0181ae29dfd9
-
Filesize
216KB
MD54471716f2dbf50c37f1534b3cf7d4340
SHA15faab44664497fb6d30b648312a12550609ff07e
SHA256139440ceb04b14c5baa343f875712ed9deac02266e344a7154e8e2e51bd4440f
SHA51291cbb9758f485bc45a5022d23cd2183bb80ee49b05cae072e017ba860e4f79d57d3e6b318fd55275fe9b53a7e228421d9415f5c0df84c77c2125d03bbbecfaa9
-
Filesize
216KB
MD5a56f2a4fede4d2220196598dd9e32d0e
SHA13eeb4bd0b373c60f385dddc9a77b0bedf63dd5ee
SHA256e3b6d25013ac143edf874901ba1e2fbc20a5672b0980350c1758645a5e1019d8
SHA5125c42061f284463012901e52249ffe4f8459e496601c441fccf0cd1cb2e50ab5f2382a17dba8f59d5c57b7b310c606d6f119bdfd4fc54721aa5fbd77cdbd4befa
-
Filesize
216KB
MD5c844266b3dce1b398d026bf9915c840c
SHA1c9877cc23cbfee6a8ba58d7d8228ed73f7556519
SHA256c1fdb875c3a1b092e40481868d427a7c3bc2e955ab2ab881b8cb4efc4fbee6cb
SHA51299143fa06cd7675ddd677e6f08b201ee8b9a6b2d893dcfac798fcd52639bf028cf64eb28100c7963cf9b37bca7ed349310bdb7e30bb9d06a71241799853425a1
-
Filesize
216KB
MD53cd9773f1a96b14246fbfae264a4dfaf
SHA16863dd709b07ca76b4d36b017550266d741bca3b
SHA25699959b33b99180177e560b9240cbd51386cd64cec16a062d8f9374f98c0b2973
SHA51275cc519e8f1996455a651d6fe18ae82d4f90828ecee2bf007865e703bff26aab66fd2c2290e433e5339cd5c73bfa0a6a112b22849652157a5430acccc123a061
-
Filesize
216KB
MD571b97dcd923693e2aeea95edab3ad112
SHA19f1db216e87c8a93ec679c491c0680012936e569
SHA2564985cd874fc8807b0aa4b06c046d25699e7cd402c5b07a9d69bd4edfca0bf251
SHA512f632f6d0cfb192d5402b1032392bd0491d1fa93b9fa0581c08b887798a1370034417ad79ce3f96ad7d2ef4664a5206d4ebde30d35c58b5b18bbc268bd28ad20d
-
Filesize
216KB
MD531d1138f7f817e0be410d45ea70adf8a
SHA1bf0cc5b1e43553cad5fa65e1081e16ea82f84805
SHA25678d2bfcd83a3f8746c090e8b432c2b4af750b05bb108366e0d55ab33a06bd7d3
SHA5121c774017e2b653e7d27069303f9530f309d95ea047b4d496dd83e08450a81cd0f57c7329593804ef9492fc833f9a58cc04020b0596a1c65c66b638668b2adfaf
-
Filesize
216KB
MD5101b5c943817c7e56e17c921889498b5
SHA1e978b243f32b64eeabfdfa44fd172a207c1fb163
SHA256b475c3bae059e3695a9f795d5bf0113e3a9aa06b28672b1558bcd8f47ec6bcb9
SHA5129d497d9eb83ec8354d3eb8674088caed01eb6c9706c2314add3c1dceaafffe7bb1ef81dc39dc4638187e8f5ab03fa013f6a1d74071797204d10481f18d92dd5f
-
Filesize
216KB
MD5063bb30b8324865ad6af0bee8c2f910d
SHA1183052ead8c30c8d4f5e59e3be166d91903293a4
SHA2561f2b891756afd17700eb24fcc4893fb4d3e33b7e2aa65f827a89c5e20f524b36
SHA5121b3e69aa067bc3f507250dda7be0fdbeb1820ef454baa968ac6c12ad621c41bfcb9f0a1c1ebb60a43bb40285a26de8bcd1408ba6aa9f46ff2c094d4836170840
-
Filesize
216KB
MD51d1fa44a22f089c64e71c1fa8f6b3246
SHA16d18bff91d9a2cfaa1004e015604da6c001dd82a
SHA256f9ad11382a9ebb67724a309de6773be856dd15eb452e534e423c08fa655d3dcf
SHA512b6f4cbfe14603a7c3ef91c56bb7034c640c8d901c84edf98075bdd6cdf8983a91e5d2b66d1bd51e9a2dffeddb02daa4d616392416067867fe633606a4a98025a
-
Filesize
216KB
MD55e8915e3c82a56b607a26e8ce2f65f89
SHA1ef7af6f40e0fd4fbfedc4d90483db61f2772173f
SHA2565e6d303f2cf0b939ec33fda5adf2905137e51f2caf7cb133b93ecca4f61b787c
SHA5127d2c6e9a122e74d68f80af6dba2925d76f8b65204fa9c100cf6657217a22f7954ade4198bb0a2c551b3beb0fffb470a3a38519043c3339f9610412b95a7b6b95
-
Filesize
216KB
MD5880f90f767b88592f54b2f9c10f75738
SHA1c264c2c89570027b12aa5b253445f6a140aafe02
SHA25621984d10f3db8d3d88c06cb91f6d2806b11f07fb04ff6feb7033ecb3a0cb7d10
SHA512727b91ae608984b736939e8e127f62cc3e6036530bf679ba95c58bd1667478088402aab86453707fb9db7cd03aff6d820936ba06da0c17214a5efcdaa2d072aa