Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02/10/2024, 08:51
General
-
Target
2024-10-02_8b953551a67085ad3e3577bda919d261_goldeneye.exe
-
Size
180KB
-
MD5
8b953551a67085ad3e3577bda919d261
-
SHA1
33a1a4f3e8d1f4dc59062ccb90abeef4b7ca2221
-
SHA256
491b134f035deab9259b8082eb1a263775bbbaf902581f81d534cbc67ebf759f
-
SHA512
f56dc91223f001d756a8eaea02a3859e2663f76c8f6b70868974eacf37bcd618aa6b5204b72ba962d115e7e1de1cfe8fced6f27203a667e208772cf2b24652ba
-
SSDEEP
3072:jEGh0oulfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG4l5eKcAEc
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-02_8b953551a67085ad3e3577bda919d261_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-02_8b953551a67085ad3e3577bda919d261_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0262C7CE-B32F-41d9-A606-6CFFC76F7EA3}.exeC:\Windows\{0262C7CE-B32F-41d9-A606-6CFFC76F7EA3}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{96752BCB-7582-438c-B949-48AFD4F2BACD}.exeC:\Windows\{96752BCB-7582-438c-B949-48AFD4F2BACD}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{39D0CCA8-DA61-4645-8263-547C3F2898AC}.exeC:\Windows\{39D0CCA8-DA61-4645-8263-547C3F2898AC}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{33562A02-8C2E-45ed-9F53-0D8A77065024}.exeC:\Windows\{33562A02-8C2E-45ed-9F53-0D8A77065024}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9CA15A31-F8CA-402f-9C3C-A9DF4951CDBF}.exeC:\Windows\{9CA15A31-F8CA-402f-9C3C-A9DF4951CDBF}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{32C5F323-5CFA-496c-A326-2D677E059A36}.exeC:\Windows\{32C5F323-5CFA-496c-A326-2D677E059A36}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{38A9D6E7-573F-4f9e-9034-E2187A053AC6}.exeC:\Windows\{38A9D6E7-573F-4f9e-9034-E2187A053AC6}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{520DC01D-26C0-4d08-85B7-1BF7A55AD916}.exeC:\Windows\{520DC01D-26C0-4d08-85B7-1BF7A55AD916}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A8122F67-1752-4342-9508-17F7F7DF9B78}.exeC:\Windows\{A8122F67-1752-4342-9508-17F7F7DF9B78}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61E15D42-65DA-42db-938B-A87C32ABCBD0}.exeC:\Windows\{61E15D42-65DA-42db-938B-A87C32ABCBD0}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8ABE0391-EA09-4d69-BA69-60778574BC41}.exeC:\Windows\{8ABE0391-EA09-4d69-BA69-60778574BC41}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{335C2CC0-78F9-49e7-B9D2-0BDE65227308}.exeC:\Windows\{335C2CC0-78F9-49e7-B9D2-0BDE65227308}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8ABE0~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61E15~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8122~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{520DC~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{38A9D~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32C5F~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9CA15~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33562~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{39D0C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96752~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0262C~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD54bcfb5b8f2fd465668ea34fdf42fba8a
SHA1f6a1f929084644440e8d1c35844ca3ca5ad38cec
SHA25638376b6121200a98cc684901871ec4d64ced1afc4d27f9d8447bf8e42a585125
SHA51259d055b27ca978f6142f5dbaa5773a34b8febbc02d1976e5c90b7fc1b4fba5fa89cda0ab0e1b6b3f5e24d089ac832e39d2d68bd33ffe8f401adc55b59a9c6da0
-
Filesize
180KB
MD514e3dc0360b9250c0c5fe424b0acf03a
SHA170677294914ee775ac020c27eee76575ad75f2a8
SHA2561dba047d835779e174f281d6c9f0c8a051220b1a571bb6219afd6ac1c303b3f2
SHA512462a3a2d9105cbbba8b5cdc7438f9be8b7d27de3a372f80f059525c3bef687d234915ac9adf64db33e1c4ac5a17478e0e8b1afa750339bc36b658fc8211507a3
-
Filesize
180KB
MD528dc35ba0fb3f415eecbd70c3465d5da
SHA195b53414adac8b3a73717941691cc76849f4c793
SHA25669fb925ee899ac3252727440d4a33b74b29d03f195f019a91f987a27d79a5efb
SHA512724c8fe09f300b84e4f69544b8172a0af6ae07451384bf5fc75205c63a0a0c78f83767b0f27cc95a900f15094a3c8894e030d99d0556823b9d525327ad602e58
-
Filesize
180KB
MD581359bdfd487068c2fdd91da92e8e496
SHA118e84a5a1e9890ed4ef904156dcc54560cc5b968
SHA25625b4d6aa4350c5d89058a8c8b2cd1366363b0a8b40751fdaf1d182565916928a
SHA5123acb97b70f9772fdad304feab28c8420a5a09ae978a8764c7c52de3187a793f19ab57867f5bad086716991cc27a13abfcbc2481f96e672e4c198b592b1c4024f
-
Filesize
180KB
MD50b46a71d6456853fee8adf387189437e
SHA10d37d5ff0b1707d3c14621c28855b4cd37141c7f
SHA256ab616edeee6b02440b8332e07e325c984c44bbad4e3fc9d95a13c75ed7e2ad7a
SHA512c6f9ed8e51f4e52a0dc7f3523bbbb3a4d3d06fd7978aac5b2e942039b6be7a8a8eb7f5c11822f8070bb2fa356bcac989bfb3eda50a1c3f340bb54341abe35ac8
-
Filesize
180KB
MD530613726793b53554cfec840e45f02fa
SHA1aa18ca19df83b9657224f6a0914ab10e60414098
SHA2567f59c8f08b800b6efb61e6cd17d84c50f5d2aaa9f818196ed5825a9adb27acc9
SHA5125de411726b87b3f0055433a7051bd9d1cde2c97ba12096e01e8619de964024d4d21ebbf572bd3073f8558368cd2c6468068e584891b9155db6f518bd02e9ef14
-
Filesize
180KB
MD5d325f8a6b113d7be93dabbe544952821
SHA17f67a82100c4bf1ef243ed52064f4b68145dfe79
SHA25654e7caef1fd34ebdaf8911f7d5a1b2f8900afa1e4b50c939e7fa1f2c97cf9f10
SHA512b785c05ec384ff53ae46168724590c1ecb1ec4c7b6afcf7dfe2de2dbf0325d7663a2b6565064e3f3f32167ff3ae954aad68f3257d980bf0737f469274b65218f
-
Filesize
180KB
MD5981c786ada7ef05c14b9e4ea4c342770
SHA1c2869ce663e4522a4e8e800ae68dd84a5c6d01aa
SHA256bdc8ae1407337049d930edc35ab26ef13751bff7ada2a5ae3bbd270a4fc9dc51
SHA512b8b0e59aa51e94dee1f6bf7030885cb46140a13b4ff361e272ab3a76d71f6d1b04e68330605c08a18110d26a0dd10cd6c0e95ed167f0b640dd826caa35607b7f
-
Filesize
180KB
MD52c9cd31601b3b5e9697bedcd62d4c79e
SHA18c322f6ff5e108cbb657e0f0ee6a5791348406d7
SHA25632baeffe992d6fa38eeb36b9c43e47a924e0d1a1c5cfbe7c7c608810ef1443b7
SHA5129610c8b3f724a5c29b9010a7792d0c55a5613a4d30ddc90834be90256b300374a97cb4c7c500883118b4f8d497f994b2a0261a24d56100b440a9a5073a5b4527
-
Filesize
180KB
MD5d402b2df2467e2795990c1ec670055c9
SHA190c25e259e308f43c617d8f093d409ac01449f7c
SHA256f220083b6aa793b4dd4e98cf73d4990950d5093c754ef9574b626df7e87538d8
SHA5122850d91ac86f186b530864bf48128b85cd5d0772f0c84b9cd92a0c58c99c0116ebf62e08966afdc87d598816c365f962b96e1a405de9dea888ef9a6a9b588b5b
-
Filesize
180KB
MD521df92c07d0de2c426db0846a8ac88d3
SHA103b4657e1240db76c2499ab080a1df80bae31040
SHA256a95f2188c80c60531828630a3a9d4784541b8fa98339350fc251776808ef4c3d
SHA512cb6b253472897f9635ceacf4961cf3283631ef147750b7a4f20e51d09524ad30cead1c0be763a9f4157995086954e4e3743f7a14de720c14b6c275b59162f840
-
Filesize
180KB
MD542f85bb2c40d5bba0d4b934ab12df57a
SHA1872d267913dad11ff9a2935a26a11c22fcca5dfb
SHA25675efefdff8a140b4f6d4b82b7e5984acca55bfaeebeaa15a299d6a7e9396d8e7
SHA5122fa428a71522ae17ff3c1039b4fb3416369d6f0431829b70a5da0e3f96a2e9fe67a90e96b63800ea65af90d5f354be6803d14c6ab34f3834cdac58da0fb3a659