Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/09/2024, 15:26
General
-
Target
20240906b058d60e02378a272481c4603cf3c246goldeneye.exe
-
Size
408KB
-
MD5
b058d60e02378a272481c4603cf3c246
-
SHA1
bec78dd7b65073ddee62cdd626baecb3899dbaa6
-
SHA256
73a5ddc6fd7b55869dcd0dfd21bc948386a7d58c3b66c235e1afd1e38304bb35
-
SHA512
7b4482ca0be4f6569f75bc4f9b8ce97bdbffbd191d870fff1822e99957eb6785ff6bc5fca5d5e3110af8c8c29a7dc8974f561f1e01ce4a1f71e0c1a70cc2250d
-
SSDEEP
3072:CEGh0o4l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGmldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20240906b058d60e02378a272481c4603cf3c246goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\20240906b058d60e02378a272481c4603cf3c246goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED65D16F-D87F-486a-8265-DE81D170E380}.exeC:\Windows\{ED65D16F-D87F-486a-8265-DE81D170E380}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC0A2A48-3906-4320-98BF-DC04BF1FBC75}.exeC:\Windows\{DC0A2A48-3906-4320-98BF-DC04BF1FBC75}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{08DC9914-B5F0-41fd-B11D-7518000D95EC}.exeC:\Windows\{08DC9914-B5F0-41fd-B11D-7518000D95EC}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1B97A208-7B36-463c-A0E2-66154BB3F590}.exeC:\Windows\{1B97A208-7B36-463c-A0E2-66154BB3F590}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{36F6F413-DECA-4c23-9E7C-38E335CFE1D5}.exeC:\Windows\{36F6F413-DECA-4c23-9E7C-38E335CFE1D5}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{65B1BCAB-6629-42ec-8C76-01AFB9FBC114}.exeC:\Windows\{65B1BCAB-6629-42ec-8C76-01AFB9FBC114}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE1CFDB5-A5F8-4832-9117-3A66B94642E1}.exeC:\Windows\{BE1CFDB5-A5F8-4832-9117-3A66B94642E1}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9155E8BF-7916-4385-A242-FB9CE8B5716E}.exeC:\Windows\{9155E8BF-7916-4385-A242-FB9CE8B5716E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58E9C91B-D287-4da0-93AD-E286352E3CB1}.exeC:\Windows\{58E9C91B-D287-4da0-93AD-E286352E3CB1}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C4E822C7-30F3-4f90-9A7C-DC6F09480DC2}.exeC:\Windows\{C4E822C7-30F3-4f90-9A7C-DC6F09480DC2}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{126C5201-9546-4a96-B2E7-9C9D1005C863}.exeC:\Windows\{126C5201-9546-4a96-B2E7-9C9D1005C863}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{225F0465-35A5-4a9e-BB5A-AAE9B5F08AC2}.exeC:\Windows\{225F0465-35A5-4a9e-BB5A-AAE9B5F08AC2}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{126C5~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4E82~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58E9C~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9155E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE1CF~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{65B1B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36F6F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B97A~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08DC9~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC0A2~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED65D~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\202409~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5f48e8beb9b3a933f5963e4fa9a9ed126
SHA154991cc6c54b1f2c38d8a870d4b4f89f97a02f42
SHA256b5d12d00967e6df573eeba3aaaa9a549d5385986b47651376f8fa7adf3c37255
SHA512e33a3c248a51a456ee8254c466cc802e485303d0ef94684afd8a6f3ede24ef5d8354d6075234fdc707a49d7062da48a906ec2f6df19a9a81e448dd790cc0a717
-
Filesize
408KB
MD5baadf0c6d32208caf8550fd07dcaa64d
SHA13e10174445052075ced4951ed5d294fbd63a42e2
SHA256ba410c605cbc6d317dac58f1d86767a3efcf178550bf54f897f1e4617b3585c4
SHA51219602644e5b23e1af7c0fbdd735dfbd93a03d71f9b97226bfcae5bfb3614d05877870011a67804beb8a7b2bac84065f0b97860521aca25d5c248705762777e33
-
Filesize
408KB
MD54c8556631a9c75ff780a0a4e33807c95
SHA16fbb2b072c3901219e2af243bbbe7c170b18f68a
SHA2564fd3172046bee27fd1a15b2843354ab776c82f52a85f977a8a89f67d61cefef9
SHA512899d8c4a3dcccf060a96d2df54698d66ab8fea551a3ca48c8c0357c75c64f83146b4b976226809e26669117ce249838e7d601acd5c131a58420257865b04a82b
-
Filesize
408KB
MD56a6d0b05114ab3fb8d8f2a722cddd1bd
SHA1552facb68be7d64658332cfc8465947f47c50afd
SHA2567f142ca09be967e3381c56f2f3a087f9202483acd37b5fef90fc54599d1d87d0
SHA5128f5b7329fbef7ae09c97cf124b59d2c94e33f960eba5813589426bd434e1ef47c55644d84c490250ec1bddbdb0837b97e9b8b580a54f55033861daf24e42c4ae
-
Filesize
408KB
MD523dab1eda21ce09545b4e688cc791bd5
SHA1fac36526e195e1ec2b42d2f17f21acd31dbb6dc9
SHA256394d7fc5dc6f106f0dd9f55c07c0f471078cfd6d25de1a451ccc53a0ca23c810
SHA512765f28dbec1f851832d856099763be60a60a79b3f667bc63be16b5b6c1188fed058a6faeac04884f0e01a4c1b7c69e58017a7b6aaf96fcf48b3825c8ce8982c4
-
Filesize
408KB
MD55ce49835a6bb765de62a8df7a8cafe8a
SHA15dcdbb6d12d7dcb51c4679f4e73688f8e4d2299d
SHA25636d887555d6384c31e82aafbc4a401834347766192eb1003f1d1232ba9d3bbfe
SHA512549865e526a9c51729748e332bec6ccee95d1b7d2858c2da6c4efad643f2de3a50caf16468c8fe952cadaace977217fca08ebe47c51dc26df3746bf6c3611f3b
-
Filesize
408KB
MD5291e920179a3e8cfc35f964a96a87e3a
SHA1a3fd67dfb81b1e933bf9163d7d8c2890bd73c731
SHA256a05bcdb9593e7387102c4df6dd5c726bc58aa414dafbe291f7efbc700c5effaa
SHA512e687c1b8debee6f2b29866a684a05b99bb895a7f567f8bbddc0a47b1501273d6261ed351985146741553548947a052b3638b221f2ad4d9a16e73b133fd03d51d
-
Filesize
408KB
MD531e05f7330d46fe1e16307d98d96a9ba
SHA12bdbd7d5b5e2b7135a45f23a01cd1282ca81ebc2
SHA256dc446cbabc79cf9500c355c979adaaea2d6f57102caf4d2c8fd476b0a982f4ae
SHA512ca06220565c17b5d9ed0ef6d04e994f97e59dc7ddf45dfcb2b3384d8e3d3b0b968a1d39733b2832aae2c23772e09039fd2de0e45ce75a1e281efe8036553a280
-
Filesize
408KB
MD5d37d8da1baad93f652fdc8abf7037d2a
SHA15f95e6e30ffcda53f66cc6772d213e27c6563f4a
SHA2563bf68378f2cf708ac68852c750e5596706dfd141a96d8530b54abe1797f013d0
SHA51216a53c89774fd37e9a5776daad1d606d3e6bdc1b72e3f8561e625908f551574670e63587fe6ba94341ada305d7d62c9f9d53d2cf1143e20aa1047fda2178cd02
-
Filesize
408KB
MD5f58857781af776e08ef052b79fb986c1
SHA1303dd7b8f2ada3f819c3aa8d32e0b5b1aa2afce8
SHA256ae99109cca815da336aaa3234bece3e1bf84912749b459be91891d649acd4727
SHA512eb95826737d085a31f5a0601b49dedf9fbec78d9eb9057c3d13f1070a1dd8dad2cd8560ce5dd61e8db21216069f18fbec4b1b0ce015ec44209faf993b4e9d31e
-
Filesize
408KB
MD5bcfe55bdf28a931e7505dbacd2d04349
SHA15163de525bcba9a8928a158b061d5f6d654da524
SHA256e0ef3bae3585db3ce665643767ab8374787ce29dccdbcaece48177d572ffecb4
SHA512b73096ff64cdcaad09c8be2aa386b1ca1b38bbb952b8cead423b4f6e88d2a6e044298c50965c6858593d2fefd6a76eb50a881a639fb20ff522821c0b600986ec
-
Filesize
408KB
MD5a81a0e38d42c9d69c290275568400477
SHA11dba99a348febce3c7c9b896a105406438abd3b4
SHA25627c9bde4cb9919e3f781abbc56cb780235a362190c2bdffc7233b8a26e9fd45d
SHA512154182c87f3510aff2a06df706ca659ceb40aaada085580a22d508342d6f7fa3e926de4b12ae91b776b7d3d5316146a420574d154d06fb34d17d11f10639982f