Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 13:47
General
-
Target
2024-09-19_51bde2fdf4845cf2e8879d44bc28a263_goldeneye.exe
-
Size
197KB
-
MD5
51bde2fdf4845cf2e8879d44bc28a263
-
SHA1
5b1c546ab92c659ecabbb2ccd489d7c6b34674c1
-
SHA256
415bcc99280f72cdfcc0a6dcf195802c118dc2d31aed18b8ba84b706c9f4fe1b
-
SHA512
65406e3db538e9021389508b2097819c5bb251878a81b1dd7d9da3884da3d260aa28af04997498b6aeefe1b1fc99098423ffbe53c37da6940da7bcb84dca0157
-
SSDEEP
3072:jEGh0oTl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGZlEeKcAEca
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_51bde2fdf4845cf2e8879d44bc28a263_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_51bde2fdf4845cf2e8879d44bc28a263_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4527DFE3-440F-4f0c-BBB6-9C7523FC66B5}.exeC:\Windows\{4527DFE3-440F-4f0c-BBB6-9C7523FC66B5}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC48701F-2112-44a1-94EA-BCB4411F46AD}.exeC:\Windows\{CC48701F-2112-44a1-94EA-BCB4411F46AD}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{42F65764-6EEA-4f38-81AC-213C830B180D}.exeC:\Windows\{42F65764-6EEA-4f38-81AC-213C830B180D}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{08E883E4-C12F-409c-8E11-E9A5599D005C}.exeC:\Windows\{08E883E4-C12F-409c-8E11-E9A5599D005C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{47355661-3FE9-4189-BCCA-786A1A3C9332}.exeC:\Windows\{47355661-3FE9-4189-BCCA-786A1A3C9332}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3D666251-9F09-414a-8EA6-874E0EE09303}.exeC:\Windows\{3D666251-9F09-414a-8EA6-874E0EE09303}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{840DA0EF-5147-46a2-B881-C7A033269415}.exeC:\Windows\{840DA0EF-5147-46a2-B881-C7A033269415}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A57B49E9-B244-4c1f-8671-50623220514E}.exeC:\Windows\{A57B49E9-B244-4c1f-8671-50623220514E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC9BBD98-7245-42ba-9189-1AA706AB8690}.exeC:\Windows\{AC9BBD98-7245-42ba-9189-1AA706AB8690}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C71379A-4E50-4883-BBD4-C76D63C0D2D5}.exeC:\Windows\{6C71379A-4E50-4883-BBD4-C76D63C0D2D5}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D23D7056-6105-4965-9A91-AF58184EE367}.exeC:\Windows\{D23D7056-6105-4965-9A91-AF58184EE367}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{09EBC377-D6A5-4c40-954E-8677DD505BFE}.exeC:\Windows\{09EBC377-D6A5-4c40-954E-8677DD505BFE}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D23D7~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C713~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC9BB~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A57B4~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{840DA~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3D666~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{47355~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08E88~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42F65~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC487~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4527D~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5faf1edc96d8d1ef7a7505bf674b72a92
SHA111789a18914b7ca85285e82bfd8be436c34ba8ca
SHA256c057c861c93fb8cda3f256223f9d6a9b84bb336b78fe4b2aee50f20193557022
SHA51223105c1f76ce27869f901b452373e07e6e43b4397720fa841a9404b2e608c0ed1cc9124cb35a91b4898acd299ff79e064af8ac96c2a931d14579956b85303226
-
Filesize
197KB
MD56288b62c5660dc42fe556803421a18d4
SHA1dd1332091ef21051ee47e8ff5d07d87bb50816e1
SHA25671bb6aa780869a7eb56114b529b22c3bdeb636f5d530a8c45b0fc9f4152771e8
SHA512f7c1826a9820e15a9aa0e10dc37e32e406074c94fa69ccd8f484c48dba7fc17b0c3426be717e95456d3302f5cf6c1a9251b0b28402254ccbc58d4f61273cc74c
-
Filesize
197KB
MD5a994eb04d6e4d7b0a27394461d1c505e
SHA1aeee2c3cfa6beab10db622b252f0e8b050640b12
SHA25651805f9cbc6feb496487c43ec40249efd0af7d10498f954b01c24aeee6517f55
SHA51249f197ffce3718bc1a8799a9dda77235ec88233212d1275f04d432a40aa86be02e408582ccd3f042693e9874be2f02edcbd8d711b37f8085b85b083c29fae0e2
-
Filesize
197KB
MD5672d68dcf4af01e6dc5c7739672c9113
SHA13a492759b31fd746d983634a4b00ae9c48b2a76d
SHA256672e6b2b02341918c16b98ef87ccdf430c64ff5749646dc4c91c025a483ec252
SHA512960ee6aaac3afc0dd83ab68b058e6cb8c7ee5c71fae73072c7c374f3d6204fb263d47ed8bdc2e843c381e3754a6906d8f4bbaf6f42581b14c73369fd163e4f83
-
Filesize
197KB
MD5ee4d5e7305f54749f0d88c3ca10c97fa
SHA1d363e836caff6e35fd4750dffc7fb1e52ecc4727
SHA256e252d5a1541e2d9a11cf842158b138c96b1b4dfa682a26d097f7ff284f30871a
SHA512ff1b3d8fb5f10e1efc20985ae60bac2cb03bb170b95ed5e1225721c05c0345c8b3d07caa4c9eac7ffbab1749e1f3634fda6aed2d819f324e60d0b5a98e5c52d6
-
Filesize
197KB
MD541670de8100c59f4bafd463806821694
SHA13aabb86aeb0ec7caff4842ee078aab1873729881
SHA2568d2e5a77d30b4842c5b9abf47584ab30acbc3f785d0897252b7301c6459cf0f6
SHA5124a1797aeebd072729dbd5695685444e694790b0007a7c681018f0be670f59e798a0a67fad81ff524beb4ed7d2271148cb0e8d1a009e8758c7fb008c14178f0c0
-
Filesize
197KB
MD51ada63a8c8224173e01cf8db29eb74a4
SHA1621c1f8c3c2a406a8722666cea636620a69fcf5c
SHA25624bc6d2ca84e70da166e77a39f04190104d739020b4c1b21381e8a44f8f0c9a3
SHA5129998aaf689b9933b5232bbc981a50481ded2ff2fc03a076ce40db42fae74c22a4c5fc8a1407e1684e2a32d4dc945f7c34c5460dde78233686b28ed38cbb27b06
-
Filesize
197KB
MD5518051d29f853973d40c69778df1c834
SHA1c5103913af29b34b9e83ef381db501df0969907c
SHA256f37022717d716d3e615222c145cca4b79862bf8e2b7e02b85d277cf5f523942d
SHA512b471f64571e641992ff67e682ddbbbfa04986ea506245294204c47072be23b8adb428762bb460cfcbbcc2baaedcc52aa1bf6612a080eb7925f9492e3aef89b7f
-
Filesize
197KB
MD5e9a0f881af0fd1517b273a6fabd6554e
SHA1287bd6a4e67b8ac023d30bcae721db1ef6cbb788
SHA256a9abe9109d45c909288cf7df7c02a2ddc5605bc5b9277978597f6a2a31af0e4c
SHA512ca7f9d9f2235670c3daaa82c76ea1470fbd9ebb0ade3f04f69faf2a37dfef839532545ec6462099b11674cecc9275d97daabb93f713d0585e6704c19b16d9e27
-
Filesize
197KB
MD53c07f378a22065087d45f28d50ece8cd
SHA1bcb1cea4770700037beea40e93446507b53d5b7c
SHA256f039ab749bd0df16d0c068232144747de2dc4869e995313ef05a438efbf40c42
SHA51264aa99afdcd90c370d7978c78d8ee6c4dedeeec1474f315682a1c532dd13b606e7fcbad8a669c3aa562cd3d026afcce283d1773344139b108ee0ad6ff2e9e93e
-
Filesize
197KB
MD5c1325e1392b4c9c85bef958290b33620
SHA1f6a31126c13c091906dd6cc10d5b24428d9e80f2
SHA256ae64b26ca61c1f66b7cd0ad9ac501a650f53758bb36237749c9ed817ef707f43
SHA5129a5c1a99cb4a562db019fdea1769bef96b8d5581716bdb9d6323d560e81fe5efae45ce8e3cc33ecdbecd88284cab370361f3171bf76da2bc0b4720b2129b76ed
-
Filesize
197KB
MD59e3e9f0c55ac899a0190fd67837b9009
SHA19422033b5d328ad8bfb61da3531a80d5e933e5d6
SHA256add1d82d1aa71599662dad3359bb7cedde89313b696ed7b32f0b49d04ddad0d5
SHA5124755d0842fcd4b3af6d6c0d2e928cb4d14f97f91c6672de227e19376940b20c09cddbdd523ad90e6b36936a17a81f85b0ea5dce01d862f764be37b9ade46864f