Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13/09/2024, 05:56
General
-
Target
2024-09-13_742ad037c317b6cab2b5464d56e65d54_goldeneye.exe
-
Size
204KB
-
MD5
742ad037c317b6cab2b5464d56e65d54
-
SHA1
84260f31d8e42d61fe9eca6bf2a2c51bc7f31f9e
-
SHA256
429ed1418f0d325f2e9e89a3b7c06175961cce1510873e4cbd3b390fdc0201d6
-
SHA512
50d27e44f1e0210f3adedc8502a1aa67f5137c6b0f5947d70c66234ad52ab8eac43e80e31f0563b1bdf022fcf9f248851603654fca2c308f9f11b7e82dc0b96a
-
SSDEEP
1536:1EGh0o5l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o5l1OPOe2MUVg3Ve+rXfMUy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_742ad037c317b6cab2b5464d56e65d54_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_742ad037c317b6cab2b5464d56e65d54_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B1A7A48E-4A32-4338-B0DE-CC0BDB8B99A9}.exeC:\Windows\{B1A7A48E-4A32-4338-B0DE-CC0BDB8B99A9}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{90B8B73E-9A89-4992-8E73-1D38F87B28CA}.exeC:\Windows\{90B8B73E-9A89-4992-8E73-1D38F87B28CA}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3D8D1F63-330C-4db6-BAD3-B675CAA49DC3}.exeC:\Windows\{3D8D1F63-330C-4db6-BAD3-B675CAA49DC3}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F78EF6BD-F9FE-43b4-A93B-D3AE25F6A89B}.exeC:\Windows\{F78EF6BD-F9FE-43b4-A93B-D3AE25F6A89B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B3D3183-3C25-4271-B950-DFEFF0238508}.exeC:\Windows\{4B3D3183-3C25-4271-B950-DFEFF0238508}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1B083C59-0B30-46d5-9909-BF32E56EBDD1}.exeC:\Windows\{1B083C59-0B30-46d5-9909-BF32E56EBDD1}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B318661-595C-4f46-8D5D-147771F01B5A}.exeC:\Windows\{9B318661-595C-4f46-8D5D-147771F01B5A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E3AF7968-3F95-424c-B37F-84435FF47BE8}.exeC:\Windows\{E3AF7968-3F95-424c-B37F-84435FF47BE8}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{630C94CB-334E-4aa7-AF39-370AFF90454E}.exeC:\Windows\{630C94CB-334E-4aa7-AF39-370AFF90454E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{68718513-9B5C-4ea3-9D3A-E0748F818F0B}.exeC:\Windows\{68718513-9B5C-4ea3-9D3A-E0748F818F0B}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DEE67212-A517-4bc1-9B52-3E9E3983371D}.exeC:\Windows\{DEE67212-A517-4bc1-9B52-3E9E3983371D}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A5BA1947-2CE5-42c9-BB1F-B4F749737CFB}.exeC:\Windows\{A5BA1947-2CE5-42c9-BB1F-B4F749737CFB}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DEE67~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{68718~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{630C9~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E3AF7~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B318~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B083~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B3D3~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F78EF~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3D8D1~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{90B8B~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1A7A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD54ca9c6b4939d1ec8e591449aa87ea62b
SHA168e099be27acfa425859c6e60b4f00c083164c42
SHA256d864e5af086e6ff7495d481d8a682ef4fba39173e4401d4f7e9cfba791b5c5e7
SHA512847be1bd40ca72d1a092c507ed0fa4c1d46404f978804ef3a64f9cc9a2e46de7f6d0a5d93b940644b21bdce072bfeeae58b58e0ff9d9f78863285009447a5d93
-
Filesize
204KB
MD50c89e0a3e2ae5a42f3a26cf8df0bb9fe
SHA1879d304a761e85ec79b4476a2d7fe9b8061790ea
SHA256a9fde5d542b83cb69c52c4e8766f26d159f4165ab77314f023a1ec4c1c77ab16
SHA512d411fd5f86b58052ff45b2f98b26acbff1f3d3f94b15b623dca36d248e82cf1de07a9685466ec31df5a7e3010817fe25a9720b16f93e8b581ab572039928d3ab
-
Filesize
204KB
MD5cd3a8bf44ad9ddb1b49d09362fe271eb
SHA12e48e18ff9f5c6166018f0ecbda91360e98f621b
SHA256da29d37bba9bce8078cc10a20a37d3d94cf3862fdd272af6d4c33927e209c155
SHA512f3e6d56f85d6003c10df7a3403900d59558fcb8a95efb495ee37ea8f1b4c5893b48864ff06b9dad2f85073fb07ef540a059f6d1f70a875be561debbaf8f020cc
-
Filesize
204KB
MD50ae5c09b0f2aa930cbf9a30a8f80a4f3
SHA1f4d3ea52443505184f181ae6c24fc66a00924f90
SHA256d318ced0736cd509ef1d45c4cbb602331844dbf636ec5c7ac865bf05667fc5a4
SHA5125cbb8e6414ddd0ef6f6ff117240e42f0295e676fc2c018f8f631e2b2dbaec3c9af0687f095a8a5b065697b01d66d75a9ce0ef1bba079013d3e7d56c291bf1b86
-
Filesize
204KB
MD52623301e4ae6afab5f0e186dcae2283d
SHA1f7858b4d84dee555488b2dced9be702427a93133
SHA2567e69b357a3f09039127ee5c15a23442a953c9ecdd9ae57a78d2710fd3bb75d04
SHA51229ee0ddbe359ce7841c4a564747f4122f6482afcba69a178d5319cb62cb075e872b5266feb5e08917d696fd084ca1dbcb1e0a2ed98206dcdaec2b2f04729dcc2
-
Filesize
204KB
MD5491c6bdeb442a69b5bb31711aa7e6525
SHA11436cb134fe157e1005abdfbba1a7719f1d905ec
SHA2566b84eafd1fd4bc2ca38eebb562f1257800ead57ddaa4739e224eef234853f55e
SHA51246dc426fc78a2c2994bd75d287dab4befabf5eccfe742cc465d8c98fa59042b00afe1802b38aaea651cadd8f1150efd7ea1547d58f79b7b39e44500cf12ac640
-
Filesize
204KB
MD58256c5ebf373f52d7e631351a022174e
SHA12ba65327ac8dc8d5b6d0487e52542dfa0fbe2fb4
SHA2567da49a67d796c76b0d6a42f37fe77bec4ac21ac09aab2978605fff9e87b11679
SHA512ae8c9ceaf8bb1b08b18ce5cbe97de2ed37f2556c5d9eb2c693aba4909502941f9a8c759e9f5c115e85011e1b9ac1c18f25fed75e76838bc9b4785ecc992b8363
-
Filesize
204KB
MD5aec231a3322d62559481b998b58675ee
SHA1c7ea78ed0e369e994fbcf4a616a789927eebedf9
SHA256ec6ba357ec48eedf2cb626d20ab6c6d17f829dd3b4b5b83338e697a61137b700
SHA512747d99671d823d550e7ff6f1560f7c8824f628d4d03139b5ea6e3367ee029bf7a3f0e55a810908046cd8190c7d52f1175a6d335db87f3022fafc54929f263736
-
Filesize
204KB
MD5c358b9e5a65936d84c981d9359cedbd2
SHA1c3f9a12036dc8f2e87297bafadb6086c87cb9f54
SHA256a1a1bab929bd65dc41ff39d45635c0ed9455a8ee01f5b588e0c60fdc56f0f5a4
SHA512e396bef94b41b309a4463c06012d3dbcf9c6438feb5beafd3079afcd70822266bf5815851bfb1bf5004420f52fb954bc307637e767d7bd816a76db335c1b6879
-
Filesize
204KB
MD5dc1fe5df3c94d3b9d04346592c4cb8c9
SHA14a63629b207963828e4c6346ebc8edc7e1341d0c
SHA256db075024bfd0f1d58b7dd267c5b1f21f81917026c0409b555898f30a615e56e8
SHA5129d4b92974aa11732a4efb534773a95c51ade5bff522b3304f01ef17bfd50f6aa4dcb38eea7227e579824d5dd5e6a8bf797680076bf974722475d2eba6acc9c4b
-
Filesize
204KB
MD5cbca8ce6e9bcc610583d5c600dc28ecd
SHA1d9e9f527ba17064e12dd25199becb5f06d5b533c
SHA256054067c90e93c9773aa7be14108e1c52fc0f76706121ab9f70fd0940f2cd7751
SHA512c2a2401131b29329d59854529e5a7518e1a474309760bdf85daaf4477470e44a89bdfab4429e7f00f13df580e14eba55730f545ed18e36c517e344cb197c6be6
-
Filesize
204KB
MD5544cf3360d79b3c8a9615faa5fe53e61
SHA11aba1eee020ce4464c5d8333a39d11484f5948e7
SHA256c48bc1150c0d6085f30b67bbff247c2d9db12217d47da7835c7177e53fa7c80f
SHA5124debd7b3112e3e6ab47fe2286f431b630f02f22543325543c887d7edd3fe25bac3dbe0c56f108d8555d3c5e50d1a6c2904d87c8a7989a25fa902faec9a9844c9