Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30/09/2024, 08:41
General
-
Target
2024-09-30_26e975bec91a0df81506da4aa3abe222_goldeneye.exe
-
Size
408KB
-
MD5
26e975bec91a0df81506da4aa3abe222
-
SHA1
aa42716b91cd3d8f5c6ad12c49a73a04830de962
-
SHA256
bb1083acc6049b71b281fbbff5ebbc0683515826d3dc2fadfce821e5562aea11
-
SHA512
b30f30b008fe05aeec4577264a82597e77f2bafb8f56179903fa620903fb3d849dfc9cb205de89bbdbaace1e5000a7ed5dd471398a6bd704e418309398048edc
-
SSDEEP
3072:CEGh0o4l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGqldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-30_26e975bec91a0df81506da4aa3abe222_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-30_26e975bec91a0df81506da4aa3abe222_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DAB7939D-2246-4951-B87B-EE026DE51788}.exeC:\Windows\{DAB7939D-2246-4951-B87B-EE026DE51788}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D5A52997-E75D-4df5-9209-CFD123BDBD42}.exeC:\Windows\{D5A52997-E75D-4df5-9209-CFD123BDBD42}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50F1782E-AA3B-471e-872B-BC3DE4D47C84}.exeC:\Windows\{50F1782E-AA3B-471e-872B-BC3DE4D47C84}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9002ACE1-CD08-49d8-9EA9-B71188C44143}.exeC:\Windows\{9002ACE1-CD08-49d8-9EA9-B71188C44143}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D46330C1-9425-4177-934E-29F6A7398F80}.exeC:\Windows\{D46330C1-9425-4177-934E-29F6A7398F80}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E838AD28-C1B5-4c23-9534-D8B3BA44D113}.exeC:\Windows\{E838AD28-C1B5-4c23-9534-D8B3BA44D113}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2BC2942A-7A91-4fbb-A217-9AF6253E3CC2}.exeC:\Windows\{2BC2942A-7A91-4fbb-A217-9AF6253E3CC2}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{114851DE-5B37-458a-89E7-D626368FE3C3}.exeC:\Windows\{114851DE-5B37-458a-89E7-D626368FE3C3}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{036B04B3-DCA9-452e-9F84-43B7FC287095}.exeC:\Windows\{036B04B3-DCA9-452e-9F84-43B7FC287095}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EDC17175-4202-4c65-9038-6C8515E3F175}.exeC:\Windows\{EDC17175-4202-4c65-9038-6C8515E3F175}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\{4FBF029D-58A5-41c5-8BC5-C22E76A7532B}.exeC:\Windows\{4FBF029D-58A5-41c5-8BC5-C22E76A7532B}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0AADCCEB-D567-4c64-AE99-1B92A90B5BF5}.exeC:\Windows\{0AADCCEB-D567-4c64-AE99-1B92A90B5BF5}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4FBF0~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EDC17~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{036B0~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{11485~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2BC29~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E838A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4633~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9002A~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50F17~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5A52~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DAB79~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD50b85fadb4b1df58f2cfd8bc6541ca330
SHA14edf25add8e27ffeacebbd4884a0bd7cd527bba7
SHA25602e2b4061e44286d6572f69fbc08f47a244c69d892e75334857271f68b261507
SHA512eec845c8b0f8c6abe1dac44183d9cb99dfec96f121dd3697c2fa633c9fb1ecf0b9eb476e83621c471eea53d94381dc40fb429345eeb4372077f48ad4b1413c77
-
Filesize
408KB
MD5d868a8cd0b38d91f41acd4fbbc08f14e
SHA121211d21da3a641531c6ee8fa102c36951530590
SHA2568e7a78fdcfff3fc8c72be69b8653ae42960d58eba12f0a855f1b2983fa77b093
SHA512b0659686aa3bf1c79d36460154ec244c5f0d60aba940f2b1b14c3618b914352acba7b922b89e4d5bea5cca8b57bbddbec3fd04f84894bf5dbdf782982e5c103e
-
Filesize
408KB
MD54e6c741dd345ed4629013898e65ac8db
SHA14f40254c8cbfdc0ad30e57e0b63d6339a12c2f69
SHA256fc3e950826b0a8ed4ec75b54ec32244832ab9394592b03f4ca780a1f6f61d8e4
SHA5124fb9d1b5bf665c35c0a6c8a0307a5c9e8bfe741c52130c1d51fb0d3d503853e73c655c240f475d2e44131e596a5817663c292731deb88072d316c10c666b3307
-
Filesize
408KB
MD58a46bdbc93e6d789b0af8f94ed5096db
SHA1714ff12baacb43983e2a62214784e8dc629337e8
SHA2569bced21478f565b2f567ab2b8cba40d39f75da65d8af33b029d64748ed5eed51
SHA512b19c4f77b840b338e4bdea4bba6dad04440e9af71d3ea7df1c1e29ec12f86889f31d837b5aaa8b1a2c57220c2556347b326f78d14763c35312f5bd5d42ebe04f
-
Filesize
408KB
MD564de1007bd7594055e0277d5a694aed7
SHA1490c5ba26c9bea002be042540e836f7c02327729
SHA256b0f1e6d64c01f46dc5bd34439858d7f49e40bc82db3530e323e5aa603f3069af
SHA512b0058d4dbbdd822c365528c68146a0ab386170353a08b7c45644b6bd02c2a1a9a98fbb64268291dd812335f149e22ccc2029aecb69356954048eacfe9ef2d7c6
-
Filesize
408KB
MD5c59cf485f26005afcd3a4dfa73691f6a
SHA18b960f4ed8b86347ed08e0090bed55f0b5f3c572
SHA256329303bbaa0b96ae3d03ac24341cf0ec8e50599ce2b95d70c3a78223607dfa6b
SHA512a4c749b6671b1b5b1e12a200ee42c214bef514a17898a5e8fb4bd86cce7a80007124c1785fff4a3262b8f599c6a00d4293b326f998a0a3504140e06972ef4f92
-
Filesize
408KB
MD5397dfdfa4c0f3c038c4ad6406718c519
SHA1696e491ae285e02afc32666c3569002303874b64
SHA2566ca22f9d7c68e1ae47d2020aba13d5a116334d08083c08bf06fa4d488c3b8845
SHA5128ae5e6924e1acf6eb36440e55ddcfb976d2fbaa25e560f9638c6eaae293131aadbb5688ddbfec02ffa8ab0729ddce566ef107aba8f2f769aab615fbc47c4a52f
-
Filesize
408KB
MD5d65cd1fc98f04edde7ac1055a6831662
SHA11f174340decfad3619e4f24f2c40a5a8bc2a0f27
SHA2561a7bd3d4a41bc96e9e9bb70f36aa5b37f87b31666e5f701acbdf0bff1dd0d1bb
SHA512d0cf4e9f73f6c6c95324abc4ed483a2c2aa2e2fa53772b6802334641068aa2484ca1036d24f0ac8fb49adf4d840d5dd36bc9341ff93a6d1c490623e5699c0766
-
Filesize
408KB
MD51b9157238186d38285d53ca96d24ebba
SHA148d037b7a2329442aeadad92a0c9e2189411d1c2
SHA256124fddf6eecdcf3bf9a610258bb9d2326976fcf44d92b025c7c16f827d044fba
SHA512f70567f600f7731670d03c01d1859c6a0864bed361fb47d527546619e42906aa59babe8299312455b577a6e5698879ce35305cd93bb3205346746afef0dfa8ea
-
Filesize
408KB
MD535822e0da20aa1f28ed25ea4209b15bb
SHA1013707424a5e777a9d1fd385b399665846ad4832
SHA256d0704ab4271cdf46307f3bf57fef9ccdb4a0ad36453b4ab2e74431e1ff6feab2
SHA512cf89316dd7b4ef20ba63853457fd328379a296eb94e0b1b70a55c376786c4f564675935d0e982cc1c00b633762199c459a4b3a609ad8d249a244d5d408087118
-
Filesize
408KB
MD5725cd4135c52318f499bb73b0f6ca37f
SHA16e5a7dee1d80f37f67b513c24744a689770ed560
SHA25639ead751512e9e5cf3de3aae5230e5405b3e5f600851f19862be5edc62df3714
SHA512ac8d246e37ff2bcb80f719294fe6af99f12ad09542d7ade7349f4620bc9eeea900feb23378b5cd1275c4daeac40fea117cba911023d42d6e374dcbaaf2c52fdb