Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/09/2024, 17:51
General
-
Target
2024-09-21_f0e4781c8f97f090861ef4a4c61a04c9_goldeneye.exe
-
Size
344KB
-
MD5
f0e4781c8f97f090861ef4a4c61a04c9
-
SHA1
cedca16776bc3b7f95e7b67ebf9fe2bd4d52814c
-
SHA256
c874c2be7c25b162b9e99bcfcf4b1242dc5724c09f8b8dd2634a826a7fd3f2f3
-
SHA512
98df69e5828857c1053bdac9ab227a747bdf07c7e9364cd1c7f5e4d6ace3cee1711cbad9a7c4cf82836a8e4c22536daedd1f4b169baba14acededa548fb20820
-
SSDEEP
3072:mEGh0oOlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGMlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_f0e4781c8f97f090861ef4a4c61a04c9_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_f0e4781c8f97f090861ef4a4c61a04c9_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C93D5E40-9B61-49b4-8C4C-6AB11E5056BB}.exeC:\Windows\{C93D5E40-9B61-49b4-8C4C-6AB11E5056BB}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A3580DF-9750-48e6-89D7-DB14145F06BF}.exeC:\Windows\{8A3580DF-9750-48e6-89D7-DB14145F06BF}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2EB5D5CC-545D-4931-BBF6-DC5457D0D994}.exeC:\Windows\{2EB5D5CC-545D-4931-BBF6-DC5457D0D994}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C597768-1A58-4d74-BB85-B16B9961AC29}.exeC:\Windows\{3C597768-1A58-4d74-BB85-B16B9961AC29}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1549A7AD-9A40-42cb-B6C6-2F9B4C16CC65}.exeC:\Windows\{1549A7AD-9A40-42cb-B6C6-2F9B4C16CC65}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B64D5833-692E-4e63-A7EC-E14D6F9C28C0}.exeC:\Windows\{B64D5833-692E-4e63-A7EC-E14D6F9C28C0}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3BF9138D-4085-4f11-8516-16F4E081BA29}.exeC:\Windows\{3BF9138D-4085-4f11-8516-16F4E081BA29}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{504B305F-08C3-46e8-A06E-D97F21BE005C}.exeC:\Windows\{504B305F-08C3-46e8-A06E-D97F21BE005C}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{033353DA-966B-436f-8153-91244846631E}.exeC:\Windows\{033353DA-966B-436f-8153-91244846631E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{249861D0-E6DB-4870-AFF6-AD3B0B6B04B7}.exeC:\Windows\{249861D0-E6DB-4870-AFF6-AD3B0B6B04B7}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3F6B66F-8021-4a8e-B125-8F603A3EE84C}.exeC:\Windows\{A3F6B66F-8021-4a8e-B125-8F603A3EE84C}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{5F810197-E275-4e03-A9AE-BF8816B7494F}.exeC:\Windows\{5F810197-E275-4e03-A9AE-BF8816B7494F}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3F6B~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24986~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03335~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{504B3~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3BF91~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B64D5~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1549A~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C597~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2EB5D~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A358~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C93D5~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5a365be439633be57daf72b26fc647865
SHA107b39a6b88f834a746b85ca1e79ecbe5d92b3f67
SHA2569eaedf391941390e7e78f75dbac6a9cdcc1bf532d8702f5b144cc32ed0cdf1dc
SHA512dbb95b991c764724cb2eaefb7436cfe4228d74ee849dd228968eb3fea8b5772057236c98dbceae79c73457fee6892f407e3ef2766879a805167224c216cdde3c
-
Filesize
344KB
MD52b4cdd2a067c7e7268640cd60c7e107b
SHA1ddcb3f1783c6e37060b08cbfe0a53621ab5212f5
SHA256ec69bd04e018c5b80dd250a3259b68eb4559dc14b1e360e188642193b1912b4d
SHA51205d7d2a3330e68be2a146b9bb2bc6a3e45288b84829f82586da00e1f344418697424ada20a6d8ce7960522dcfe604bf5318ba1c594133534ab03420dcfe75757
-
Filesize
344KB
MD5687245fd7184bf42c65c83eb5ae54189
SHA12552d6be9a2ef9f7b818bb36e79545e10b272355
SHA256f636680eb50ff2eac71ab34b1cd4e99f509218519ce6480bc40a30e67188df5f
SHA512a7b2d4d620e4fa3cf7714f6146f23436f2fbec3173e0d414e5210d77010a9e59bc7d1f3bd06bbc3529529434abcd43a4a63fbdbe8e4c932f80426eb885404554
-
Filesize
344KB
MD5729c7562abf035f476d2a90d57d07b76
SHA1dcf626388be31395deda04a78dceea31bee224b5
SHA25668bf568fbed608c64bec3f657d8c43f6b419fa185ba8838575036b1a01b805f5
SHA5126cbdc127b3606cdfae72305de395dbfdde9fcc1f4da20b99572229dbc9d7ec7aa7896c3ada548f4fe1637fde1d0205644261f5001533a2b0c972d2d45cd8944f
-
Filesize
344KB
MD522751ba8427ad18856cd280b88e71090
SHA185028ca4d614b2e09067a4af28d409a7c2190f3c
SHA25618dc712927d5480024b167ec3da3bc9bc528e2adba89172fd8c057b6dae6304e
SHA51246e5433edcf69eff6737aece880673fb4c86199beaeb76ea448d1e52595c1f7853a5eeac4ed4458bf89aff63bfe6cbf1de96345cdf38268d5266f56f9fe32bd3
-
Filesize
344KB
MD5b3033fd6ca6f072f0d759b61cdcb74d3
SHA1568723003733895a9af199dcfb25bac9c05c56ef
SHA256426274676334d602fd4f812cceda3a0fea46ed917849a60503c7fcf259ccc324
SHA5128f48030464246e1caf52951bd6c145cbe199fe33197573ae9798a98b89abb8c3413559de383bf3205b57665bbbcf79ac921133e292ff9d1cfa870ed5c155904d
-
Filesize
344KB
MD5fef0059732f13a6304e463b18e6dfafc
SHA1012d38182ef55b84c3ec1b3ea163a075bf126465
SHA2564b9557f590721cc1a24b95bb72fc3a2ac7fc90fc2e74a3cb259a8ccb34dfb7ee
SHA512c5778ac2584b4039ca9369c49ab5ffd3899f34c6c944d493ad7f2fd94f95847b1a5ed09b6cf0703ba54ef1de53ae3b5713bda6cc718d054dd70e3917c932e5ff
-
Filesize
344KB
MD5ae5eb3571ae8757747fba0353d474461
SHA114708d387f5a3e2f1fbf4b4e37f533f8fde9eadc
SHA2561420531031cae5fc3c55cc5d9ce88b2f9d3f6a429480ecff40038f60def1f552
SHA512aab0e191f6cf56b48d7ce26abf367cddf09795aa41d17d3ba52a255353b30582322ab017346f02ba8e77170ed35f30a98393ed90afef1bb2318db794ba691eda
-
Filesize
344KB
MD5efbf6b2563c0524c5ea7f499752e31bd
SHA107d162d01ae0a3e81a33ba5272193170e9775ec3
SHA2560c5a2457d2c5ce542903d1c0412af2f1b92fef01d60ffd9ab741bf5808a92f8e
SHA512dc1aae1f71033e1f61a823b7b8fd6f192f786aba46419bb7f35e22b5a868aa37731f1bda0a4636316243d84aa91cae8eb47d9186371bf6bc9fb818d55a039f14
-
Filesize
344KB
MD57adc18bb7da2c84582eed1a07e5c019a
SHA1f715377e16275133e071e5ceaea9b4eaee3253ae
SHA256c980e7ee71c196fd670d9e771cba00aaa820ddba00ef0b65fa2a8e47e4272156
SHA512f909c04f4097655c2a1b3ccc01e8fb747f82e8ee99a7758e22fa034fe5e4a0f823a2b272f43866f1613aa2ed32baf647d73cea8c22c671bab0700333b51768a7
-
Filesize
344KB
MD53e2bc0160eb4101a3c543aee93a5abdd
SHA182e2cb52020299e1cd05bdc08ccbe727da621967
SHA25630c0fdcfa34a15c41579a32e7cc69e23da8ef344b2eafb26b473ac1a7e00a32d
SHA51207bc1ecb7609eb0fdca228de94ef28701ca86298e35ecaf33f99262f7181b5feae279cbfd19b2f6cf30dea613d170b2a044673fb520cd8e0683431c51b692c48
-
Filesize
344KB
MD5f0e0af37e12e9a6d4794ce3adff1a4a5
SHA1302f89f86f841183a9345ca1cd82357bd4cf198e
SHA2565d24db7fba08c35666184d3d8046db08e2ba28ca679d0d7bdd61ccf31100154b
SHA5122d93d8ddf492ace9998f9e83a1933395ffe093dd1c81dc1d793bb643639dffb3e98291911225f3d5eba770955ec806a2256c8776bc486a5a36d5eb2610bd2767