Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02/10/2024, 08:44
General
-
Target
2024-10-02_7959c1eaea681847fd9e9f384d96a7aa_goldeneye.exe
-
Size
192KB
-
MD5
7959c1eaea681847fd9e9f384d96a7aa
-
SHA1
342b130232be1c7fd44a6acc16cf92180aad426c
-
SHA256
fe1c869a097ae9f46720cbada0ea43bbd590f2f4d049d3bad0973c7d9ee013c8
-
SHA512
fc395695c9f0cae0945c58d67c15f69e270f6c54ba71aeccd2ff9e98da2047018d4e21f3a6364675dc47f4f4fe77c83b565bfb6e2586d93e4e115313bd3317ce
-
SSDEEP
1536:1EGh0o+l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o+l1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-02_7959c1eaea681847fd9e9f384d96a7aa_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-02_7959c1eaea681847fd9e9f384d96a7aa_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{17E6CAC0-D257-4a55-8CCE-B0C0D00F557D}.exeC:\Windows\{17E6CAC0-D257-4a55-8CCE-B0C0D00F557D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6123F79D-E0C7-478e-93CB-AA82EC553C2E}.exeC:\Windows\{6123F79D-E0C7-478e-93CB-AA82EC553C2E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3D4D6A26-320C-457f-B0FF-A6C696AFF0CD}.exeC:\Windows\{3D4D6A26-320C-457f-B0FF-A6C696AFF0CD}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{413AE0C5-CC9D-40f2-8C6E-09F95C67152B}.exeC:\Windows\{413AE0C5-CC9D-40f2-8C6E-09F95C67152B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7692BEB6-93BF-44e3-9AE0-3178A728A787}.exeC:\Windows\{7692BEB6-93BF-44e3-9AE0-3178A728A787}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0AB615FA-D4ED-4fb0-B288-A1BA4F4E4007}.exeC:\Windows\{0AB615FA-D4ED-4fb0-B288-A1BA4F4E4007}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{337DAF2D-9E78-4f81-8451-3826B06BDB15}.exeC:\Windows\{337DAF2D-9E78-4f81-8451-3826B06BDB15}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A2C30796-CE5D-47a3-8E91-8FA9BAA76F92}.exeC:\Windows\{A2C30796-CE5D-47a3-8E91-8FA9BAA76F92}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E4B2C595-9AC3-4537-8DF1-B353AE54F9F9}.exeC:\Windows\{E4B2C595-9AC3-4537-8DF1-B353AE54F9F9}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6426F51C-74B2-4873-9929-CDEEFC54A04E}.exeC:\Windows\{6426F51C-74B2-4873-9929-CDEEFC54A04E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{27188799-D803-4378-9399-BD6BA6B3E682}.exeC:\Windows\{27188799-D803-4378-9399-BD6BA6B3E682}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{5EE46506-42E5-484d-940D-552960EE710A}.exeC:\Windows\{5EE46506-42E5-484d-940D-552960EE710A}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27188~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6426F~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4B2C~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2C30~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{337DA~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0AB61~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7692B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{413AE~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3D4D6~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6123F~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17E6C~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5c0845909a9202f5388e03fb12b11d455
SHA189587852614bb04160190d30091e81edc40863d3
SHA25634d9ba480496e8bf0a2930d991278bad9c78f1382fa72c08f115e8ca4f8891fe
SHA5120cbc66f59fd59c3671bf96cd44072d8b45c67cdbcd8f83d18fcc3db9f6d7ff1907e1c1f44841df07e80d435bbb84ed916856b7f0b0d98ae965bdd980a1490228
-
Filesize
192KB
MD526378c1e88a458dfcdf2c786d07160b4
SHA10391dda3ae5f913986513f6e6f2c369863dd9064
SHA25655be7d4a33c7fe339c9f37236c8571e27e84c2b1a43632e7a6f01c1bc61a3968
SHA51291a6771dc7d5a18e87fbd058b31830132d9ecbaa1f7c1e17aff7a6ee1f88c5ec06de7241b27d73d706d229a7c6738e72f05b5ae653a049e7c74b1c8876a85e14
-
Filesize
192KB
MD500ba68578b015c2085c456d1e7c97fdf
SHA1f50b930a8784342a8c46d48ade002dcec06b7226
SHA2564c213f16efb644d9dccf9636c0f67098b7e36b3a653ab24ec4cb0bb4a19aec0e
SHA5122a316bc3d3ba1150b897ce574758bf4ac04d2fc57b4731f2bcb8a79565ef01d26324afa4fe8f2141b46d4a7fbdbd96bebc856f479960644d9823477b609b1e1c
-
Filesize
192KB
MD50802340eef064d44a0db1bfbdc38e8dd
SHA121a570eae519952c106f8b1650ff43ae1af4f804
SHA256942805d735cbfdfbad9605fcfa7a35224d58500a9f4b332bd452fe568422f33a
SHA512dc544ed4af2ac98768febb9741942f288dd7111ee50dd32b9cf2f4f6ebb3069526d5e53646be4efbbe52511a1d11012c0e144946ca3e0a4d3739088872e7e088
-
Filesize
192KB
MD5414ddf87d424bec6239368793dce08d5
SHA13ef9e1b52e8bd2e4223f7752d9d517ed9d941379
SHA2562558ac10184c2c4c785b7e00552d227a8d37bf66aeef31c26e92a98b08325d5a
SHA51218cdf11ebb953879ff9e44edea0fbe4f8838af2db26cbd908c394398f8a577783db7bfd2dccbf33f83b68761d89fda1fc1c2fc6dafe9ee0d73923ac607837d5d
-
Filesize
192KB
MD51bc7a9f99607ac4fdb133dd5d3c9be5e
SHA155921269da22c9d131c80fdbb4526d583474eb1b
SHA256f2622fb90070e7c8c9586825f07b4769e78cc1515c0c9354b6c46bb19d3c5877
SHA512473e78d27928e6f2e0572d78952fe6832635fb7edbf1e9268454bae02b47f50eb30c44002e349640d2a870cc0ac8569888cd0491293dcfdf90640a3af0c790d7
-
Filesize
192KB
MD58b1a961ad6ddfb170af9db8e6b325965
SHA111014967f82ce96c8a72fb74c582c63aab021646
SHA2565c0c4f9745db0ec5d666024ff12628d16155565a72b307e83c48742c75ce4d42
SHA51224ea1735129a142cc442740acdbe7ec51890f0d55bb8f20fe0d150ec678d08774b91a914d1e811432531b964520e0e7cde626f7f4ed2389559fbcb208cfd8dfb
-
Filesize
192KB
MD54d396e380faa51329c648b766e4ceb86
SHA1cc33c1d1b525d92145d9a70aca6523d75ecfa2cc
SHA2566e3554ea2cfb0dd3a45a521ff3a5495d230a1b3297fc8d697358ec7e98e709fa
SHA5125f5e2bd14d9d3c15971276d2d54582795ee0d30476dd8ff68514eccb47a9aaac4c4081a21ece3b3bfad919a374a1233dbc4cc924c588c2088bd8ad1bd1cceb6e
-
Filesize
192KB
MD51ffd8c4f3d9c7d74bc25b2ff9071abdd
SHA1c44b1356643cb4b50e2d3d6e2000693cd9a122e2
SHA2569ee5166f3b85b05bf95ecdc8528fe085919d6281997af07917c80f24e0eb3b1c
SHA512efc93e1defc9c3fc3a4ce9d85b1c196b86c43b3cb7d9230e649bc4a5141b488d66f281d7ff9da804ad08b4b861a2b37fc61f0b6fafcc2d495a6ded1fb83a0914
-
Filesize
192KB
MD52781b1da02c730afa7eaf24da4eec8cd
SHA1dcb42c8f5857713eb55ae2cbdf8949f784439b24
SHA256c3f8af0a953a9d576f9b80096819432ba229de530e8e684275bfcd3844c1a2c0
SHA512cbd8d7f158c1f387a08a3bd2e2a0355b72d9018e6b5cfad84ae1221c03864045e91d3839c147318ea5e25d0f9a7ec28efc335eb1d2b295db50f5175b6f75839c
-
Filesize
192KB
MD5ea7468d158d60805a57352fd8b4d0a39
SHA1919e2044c48804e056d546576d1bfeeae09d6f77
SHA2568720dcccf0268a52fd8ba1e999d2ea1921566c6fbfbcdf33a6e7b04a26b049f0
SHA5120795fd720e35422451a0d2209e5de8ec7e3c5a05ac0fd52f92acf8690bc14c69a4134a810a60edfc5a6f86633605b3f454ae345932531bf876eaef5006afc053
-
Filesize
192KB
MD5e3b30bc8bb232a82b817610800bfee5e
SHA18d7c78f82bb67ef23868cf33110804ff30f032b7
SHA256f5044ae300b2d87cb42ea1644fb1d15a8442b7ed6e63c91cb375f2e7149abdd0
SHA512e2d1a29140d9a57ecc7cfebf1f9cbdc88bcbe97af44bc73311efd6f5b79ae8535bc1495ec0038b41e40dbc214179fa361aa04f2f66ba4f772c5c531bf1c5a119