Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13/09/2024, 06:06
General
-
Target
2024-09-13_e35965126b7ed6a8723a41c4598ea358_goldeneye.exe
-
Size
204KB
-
MD5
e35965126b7ed6a8723a41c4598ea358
-
SHA1
73397af636e0bd9d37144deb7ec14674539001e8
-
SHA256
591018a3d12bc7bbe98ff48623d2b4a6c23e72fa1cbd610d1814ce581c80b41b
-
SHA512
c7db4a5414272a58c6b84a0eae34c0b1b9f1f37c7ac7fc445194d6256b06fe8a03f20eb2b69c19e58e858e488886ea13bdfd89efdb6f384590612381b28af4db
-
SSDEEP
1536:1EGh0o9l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o9l1OPOe2MUVg3Ve+rXfMUy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_e35965126b7ed6a8723a41c4598ea358_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_e35965126b7ed6a8723a41c4598ea358_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3E35E6A-B81A-4195-8905-07A3B4DEED3F}.exeC:\Windows\{B3E35E6A-B81A-4195-8905-07A3B4DEED3F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA008894-2AE4-49e6-BC45-5F18AA4F2894}.exeC:\Windows\{FA008894-2AE4-49e6-BC45-5F18AA4F2894}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8F0E991D-D10A-4b4d-AC77-07FC32397976}.exeC:\Windows\{8F0E991D-D10A-4b4d-AC77-07FC32397976}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFB8BD89-FB46-4e94-81C1-00E8D8797509}.exeC:\Windows\{AFB8BD89-FB46-4e94-81C1-00E8D8797509}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{500DEB13-542B-4110-AA29-BAF8F2633FCF}.exeC:\Windows\{500DEB13-542B-4110-AA29-BAF8F2633FCF}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{73590DDA-E985-4020-885C-B10D4D567ECE}.exeC:\Windows\{73590DDA-E985-4020-885C-B10D4D567ECE}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C7463451-429B-4093-A65C-B6EC5B620446}.exeC:\Windows\{C7463451-429B-4093-A65C-B6EC5B620446}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7D57CC75-E812-4ed4-9511-7A3EEAFB0A43}.exeC:\Windows\{7D57CC75-E812-4ed4-9511-7A3EEAFB0A43}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E8449476-605F-42f1-AD9F-0FDE8EC9E862}.exeC:\Windows\{E8449476-605F-42f1-AD9F-0FDE8EC9E862}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{478BA865-27C2-459a-9BA2-44DFE1956F68}.exeC:\Windows\{478BA865-27C2-459a-9BA2-44DFE1956F68}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D90E0742-744F-461f-BB8F-8939E7FBE193}.exeC:\Windows\{D90E0742-744F-461f-BB8F-8939E7FBE193}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{ADCD2FFE-877B-4894-BD6C-5AA659C679B2}.exeC:\Windows\{ADCD2FFE-877B-4894-BD6C-5AA659C679B2}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D90E0~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{478BA~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8449~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D57C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7463~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73590~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{500DE~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFB8B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8F0E9~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA008~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3E35~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD5f1d415bc67f863156148547296adb6ae
SHA1106e315158848f7a664f2abc95895bfd4a12a081
SHA25665d94c323360564478d46d6b084e5f68c39174bddb1df7988d01473d777dfb02
SHA5124c44eb27311767a5e00a8bdfd2d4c69aafd7801108633b311099d4800a0e9e003353e2f26156a40fa763fd36f484e12199bf69e6e2f8f44ec6c4c15697e4cf05
-
Filesize
204KB
MD5eaebc0b4deb94bf8b01a3474f6071381
SHA1ce2c02d0c0221a9ad3e9cc88bd6ba58c232f6969
SHA256299c2e93c06eb6b4c25012965d77c2f883f92e9462a02ecdfab25954b7eb0abf
SHA512456007ef6f8093fc844015252c48e487d93ddcb25f1cebad15661d826023ded412407612915fe00004d4e7b317f18a0198963f1b9457c3ffdbe34000fa4e6f33
-
Filesize
204KB
MD534ed627d6bd2cf8742f2bb777a5e0797
SHA1dd2155cd5002173f57013b646950fb19aa1c58db
SHA256667e4a44da41975312704c609accdad78e8a346ba6864fb03cb0512fab978782
SHA512c6a14baf351ff26649a98817222ff66e19f11556d71bba29f2d39a705d30d5cfec1fd51279d78cf1af8c8cd4357dc2d23eb7b07d7acb01a4fbc4af7c07ce66d9
-
Filesize
204KB
MD59b5d8958c5ae768730226c41e0686b4c
SHA192baf30ec23020fd8f89f13b1370161645a873ff
SHA2563b48d3143f52de58b4238d6890bcf7df453dd543ec463cac74c718be37abf8fe
SHA51285a68774e4f3903d39be9abf621940633e8dc6f51b73856d9e0cfaf18613dca66cedbbe85ef1cf749f94875b04aba337832342ba84e2fa064f993f7e61876885
-
Filesize
204KB
MD511e55f9d7245bc1a3c85b4d52e3aa41b
SHA1eb06e58f3bae45a2fe55eb42864cde1447ae77f4
SHA256a1cb27c0ab0306ddc8a77d3a8eae20846eb19664055853547ef6c7d3d2838539
SHA512841fafbdbbe41c23db7accf23dbf5f208af9afcf9388b3734c15d49936aa6ae1a9ecbe2d1eca7a752f08ba1dcfd9dab45c82b310f85e3596728be134bf772160
-
Filesize
204KB
MD590968da675dfdcb52bbc17c5a9581f4e
SHA198b4c9b53f7d721c306b0ff2ba72cb95d4b0f727
SHA256ec1ed8b22cacbecf7345b7fee4b563da7c56891e75226e4b9fad72380b964e91
SHA5126301a093e7c72c5ac3a34326acc1d1de0566fbffdddfbfa6d9b6726ec076db613535559fcc6025f6de75193d29390163fc06a43b45f267a6cff5fcc3f5321680
-
Filesize
204KB
MD58fffc6c681501f1ceba34e620f455995
SHA1d186af0a93ffb59ec39d49ce95e1737368159917
SHA256843f806ab76d6ec739281d5693fd952a6d0e48038e190d0b1b57c8d3f939c32b
SHA512d0eccbc4d296a246e2afa6e06aef867f67d91e48bf82af7d15d575e5f809ad875ff77daf24f08f60778bedbb7c17671504f6dc825d2b612c21d24759781b4d3b
-
Filesize
204KB
MD5437456a9e7ae3707db140a0c80e4378a
SHA1e52cb584eead2ebe1770f4c5fd533689a920770c
SHA25642173d1fadcf23072606c8a25cf8e5d59e269c362f070a80204dea453a88cf0f
SHA5129ee967c2b0bd441642fce8a36eba194b77dd78fbd772fc96a854206730d5744bad132194075b695eab0b44bf93a900f99d499938e32759937c03877fbd99d450
-
Filesize
204KB
MD56d056932dabd32d0aa35892e7e2c2d2f
SHA1c44200866f32e05457be303d6d635fa0a58cebc6
SHA256b20916f633c33d0af5378e350768a58120d0beb6d49b6b684f74ad40901e0e26
SHA51294ed8190597ac586ba24c3b12e648db384485899416a11899688a2eabbd20dbb476902de0069224e4224cc02f8144f6819dbda61fd7c4d166e87388fb3c88e21
-
Filesize
204KB
MD52793da2e452137ba5a0e5b351b0fa7ef
SHA18934dc096fd311e29d5f5c7b368d2c5e21ff17a2
SHA256fd082d113a61b1d87c257f58a69740263a0d632c41d69275027202c0a8473ec9
SHA5127942176e4257752a0c810b01ccfd7f60ae5e1f64682bdd6ba60805e1596f6839eb627df05ae2e414ddf7acb659243901ed9bb2ba5f3247037138ac1b46f5a5c5
-
Filesize
204KB
MD53b9fcac7475b47d921267581efe1ba84
SHA1444aed7439e5eec8943b35f39dbfea4f1d5923c9
SHA256409b4113a53ce1c4f3b006fbb53a0d499c355f2860a221c9ac6bc347eb7ba704
SHA5120b66b9425a9e47b35bc670d2a3eeb3a23453b88b85ce7edb88f6c0ce09d8db4193c9c8d74dc91177556a99092bb4dd26b113c4514ffd8017cb809aed37ffcfe1
-
Filesize
204KB
MD50c59fee8c2cfb92d94038b1695dca6a7
SHA1bc440ab92d736f9d4b762140ac35fa580f856655
SHA2569c3b85a0c8b9a7bd52ab499d172f360d9a490b41d9bc7b4fa5dc2418efc38b01
SHA51293bc0ba0791f39b67238b31764a4d413c27e413305d011ae331a09cce8e9ee024f55b375d566ab6bfffec6d59fb5bf8c5c23471b41233fbfc9bd1b8cb610e182