Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03/10/2024, 06:45
General
-
Target
2024-10-03_241f8f0511fdf1319272d1865b2ece06_goldeneye.exe
-
Size
344KB
-
MD5
241f8f0511fdf1319272d1865b2ece06
-
SHA1
e690affbecc59ab1a3042d3cfc72160f9a70a726
-
SHA256
934767a8c72aee241f1330d4fbd5ae207cac7f97601ef78fe2d047c47f60dee0
-
SHA512
910488dffdb476245926c7c4f97638a166683bad1322ddd6d5aa3eb3b1b39c31836933726cdf254bf7ead045ef84d565fea75d34322c0380dd131bb88b52a289
-
SSDEEP
3072:mEGh0o4lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGulqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-03_241f8f0511fdf1319272d1865b2ece06_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-03_241f8f0511fdf1319272d1865b2ece06_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{29AF187E-C24D-4567-BD6F-FED3690B0BC9}.exeC:\Windows\{29AF187E-C24D-4567-BD6F-FED3690B0BC9}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4D0F3968-8348-4f3a-B7B2-50C0329E7250}.exeC:\Windows\{4D0F3968-8348-4f3a-B7B2-50C0329E7250}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{356A2615-7591-4476-8E7A-D6DDE08F5264}.exeC:\Windows\{356A2615-7591-4476-8E7A-D6DDE08F5264}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2E1B076-B536-4fe0-B0BE-DA22B7755D81}.exeC:\Windows\{B2E1B076-B536-4fe0-B0BE-DA22B7755D81}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ADFEC2EC-1BD6-44bd-A872-6ABB2CB09272}.exeC:\Windows\{ADFEC2EC-1BD6-44bd-A872-6ABB2CB09272}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{687E726E-0D60-4e4a-B55A-007E74FF1F54}.exeC:\Windows\{687E726E-0D60-4e4a-B55A-007E74FF1F54}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D40CCDF7-2AF8-4d1f-8D90-5854AD959E01}.exeC:\Windows\{D40CCDF7-2AF8-4d1f-8D90-5854AD959E01}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{29415136-0A89-46a1-920C-6B1CA41300D5}.exeC:\Windows\{29415136-0A89-46a1-920C-6B1CA41300D5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F5E09C8-615D-48a2-A457-C0FE3921AA67}.exeC:\Windows\{0F5E09C8-615D-48a2-A457-C0FE3921AA67}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{286B8F4D-C9BF-40a4-9D6A-ACC4061D73D3}.exeC:\Windows\{286B8F4D-C9BF-40a4-9D6A-ACC4061D73D3}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F699BC4E-6346-4bb0-93B1-BEE48FF74261}.exeC:\Windows\{F699BC4E-6346-4bb0-93B1-BEE48FF74261}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B159D980-B3DA-4711-8406-2DC8BACC4C5A}.exeC:\Windows\{B159D980-B3DA-4711-8406-2DC8BACC4C5A}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F699B~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{286B8~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F5E0~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29415~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D40CC~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{687E7~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ADFEC~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2E1B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{356A2~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4D0F3~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29AF1~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD51a7b202fd1425a1a20c37c7e66da8672
SHA1b5dbcbb538ca061554f5281abe680669fa2992d9
SHA2563737f6d3f3c4665f1c436c8b61ce3696563a22124066bdfc885fa134ac5892e5
SHA512396e3873628ebf7ca3df2ba8a526fc4a4d3ad698017901475e6521d0295ee9b6ff11e1154d8f93fe3ef12b8ac380c7f79759ef69b4e48fa5d3267e0220f8df9e
-
Filesize
344KB
MD5fb6d00b8bd9ca9856a33b51b0f7998cd
SHA1c0ff59d37aebc7ce9abc534a14627442e8d6e924
SHA256bc8dac1f7ab83580cef161598e359f1a6ff5111635f83263e298ddfbef6d5638
SHA512cfe4508ee19939c2a9861e9a51fab960153abedf05268e6a4bd92f20cd67ce5b56badff389e0d5be0917a90e9892e1d62228ef08f564210df8a0e39002f75fdf
-
Filesize
344KB
MD5588f9515b1a16bb00a3d2fa340b93931
SHA141cb53780843f1b4449d5ea43eeee3a0cdcd4702
SHA256bd7a6291df7e57aca22e72465ede55f810871b4e2f4b5623592ee39d6ecb656c
SHA5128cdf705a11bce60e68374435818a3cb8f0cc05f16f6b8e224e0b8f3ddcf53ed4910542d3dee23e755c7cce276a1175445c34b9d479815c4b93d6a283d58dd654
-
Filesize
344KB
MD595f68d2f6000451fd70ed9917d998e30
SHA14337dcc18199997468abad2fbb65a1112e30c421
SHA256601a8c2f0f9e45c4db94071f837614236865f5da34a0c5ae3d64462be49698aa
SHA51294dfbde34978f704636667a64581dcdff7fd3740643e38512772f53388d9874a9a4872b59ed102f8fe4ce3912a9550e8039c7623ce9d0b8890c3e62549f1ddc0
-
Filesize
344KB
MD504fc57ea3857975e1aacdc58965d6373
SHA15df7db749a27e13de80a1bdf769506d671421595
SHA25633339ff6ffcdf75eadebb39e1789d6420af88aa9dd68b7a00314fea666ceae31
SHA512e381ca3dc4db60e270e1e6c1bd4d7650c1a7bb71bac7a057f3d779643a6969e1e5b6d1aac1bdf404323d0555c4083694012757c512cbf0626f508426356f1504
-
Filesize
344KB
MD5551d6641ac29b2447ecf5bd43a8292e7
SHA1f17b8dcd53431a2699c91dbc98cee8c5d9e71479
SHA2565d5e8469670ce70aaaa5c0ea232df6e3bd74d462f241b74ded42dbb79d173749
SHA512428e7071b6f52161dee03804a2fbe4d58c360e8e2deb3865c332b4474f41dcbfd8bf7d40f3786f58abc132fb37981a262460e41f141787b108547c0406073ada
-
Filesize
344KB
MD5fd4f8f79bfb07ad37ef20077d98fcdbd
SHA1211d3c9ddab3f0b1e7d174db627b84465f0752cd
SHA25646d6865ba50666214cda261bcd72ea58fc960eb34aa97a3c66a8da4e2e06315a
SHA512f8c4d24cd8deda83a59279fc3d26858847d298c2ffbc0ec95c0ce4a71fa9067d6234146dc9d625c45b927d6279ff00102697d573d0637e984d7bdab1aec62a75
-
Filesize
344KB
MD5ccfa41e3671c0fde6288645f1cce1c00
SHA1a1b613640e85e949fd46248ea5c0ac5f5d102b2c
SHA25691e2ba66bd1780925c7275000e16c75924b23274eb2b1fc9cb364fb3a157470a
SHA512e8104b22b565e2ec9a085a70585865631921f0a4240daf6395d89747902db461f15d921af810e969f13ce1d7ed3c10dc753af3247d1ecda09065992a13d0dec7
-
Filesize
344KB
MD50c372897acac048e985633cbdc3c4ecd
SHA1fcc6d1aa4f75430db52c794614e93d47a6f0b738
SHA25609aaa638e6b97ea106eafd75d75f4a852c10632063e799ee9763b667cf4770a6
SHA512f8aff7800661eb26b42f123c761e66912b5ff15a86fa9a64685c31f15a442ffe7c88bc4a175a59e72c33d606a5e58e404719bd59bd60d97d4a4b19736df658a3
-
Filesize
344KB
MD57d11352bfed1429280fc858271ce0104
SHA13386ea37389b0f99f7128ad8e868aa983c2a9e15
SHA25686788bade24305d69b462f7fa4a13b31c18c19b87f84573b3b2cef675791bd46
SHA512b24baf49d70e999bc1d78a452d49bf0898efca47a8ddcfcf45732dd19fa9cbe765ba67cf04afe961f31ab4e913f4b960d8b2fba42162ace39f909772f59ccccc
-
Filesize
344KB
MD51ae589761491d463b34b15a20a79bd25
SHA19e626144acb67c5d2672f85555cadf6ac932ca4f
SHA2566c8cbed7e5d6eabcab26a5cba535a2ab71b94ea425b65c98722131f4153bd41e
SHA5128f4877584f65df503372b4eca09916b6715693b7a05a378657e424903325ab43c616015c78f3a616c28d79c1d0a85c4e02507ec594c11eca9199c76f9dc4df28
-
Filesize
344KB
MD5aceacfff5629aa1a1d3792526dca61cf
SHA1226c33dc25918c9a0df704975d58c7d9d54c58e9
SHA2567cb90b669c6f8be4227f8a2dd77b75a41769f34044f69f173f88db7dac5c66aa
SHA5123163c73b44e2743ee1bdbd3762085da1eae51760bc30a3f54c04dc2eb07acffbf3d2d8512469794de874590e898348c23906103ddd8dcaef1fccd8969cb136a9