Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03/10/2024, 07:00
General
-
Target
2024-10-03_fd1441d9179581a63cec50659e4b2665_goldeneye.exe
-
Size
380KB
-
MD5
fd1441d9179581a63cec50659e4b2665
-
SHA1
14b065f52946c65bf2ac43db5990bc964bc71554
-
SHA256
56e02b5fa11e81e31378ddb4e0b63db656b7bb647fa16b7384437ee2eaf1af39
-
SHA512
1eedbc17afc8f31177b2096a6aaba3235fb49b5cfd5176d3e86b72c1ce2c193ab0d6fb8f9b3dbae6181565e7ec4765881c386e65b0f8aaa35a84319d314f9085
-
SSDEEP
3072:mEGh0oDlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEG5l7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-03_fd1441d9179581a63cec50659e4b2665_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-03_fd1441d9179581a63cec50659e4b2665_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{398A0372-5CC2-4203-B3B6-E462F6E46583}.exeC:\Windows\{398A0372-5CC2-4203-B3B6-E462F6E46583}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3205093C-CEE1-4c62-843A-44F586F6A439}.exeC:\Windows\{3205093C-CEE1-4c62-843A-44F586F6A439}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E2DD229-B4F0-4f8b-B5F1-6CB2797DCEA2}.exeC:\Windows\{0E2DD229-B4F0-4f8b-B5F1-6CB2797DCEA2}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35A484A2-1994-446c-8F78-3C8B7E97A81D}.exeC:\Windows\{35A484A2-1994-446c-8F78-3C8B7E97A81D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EA466A61-B352-4e8c-949E-89EE68007CBA}.exeC:\Windows\{EA466A61-B352-4e8c-949E-89EE68007CBA}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93F4BA9E-259D-44f6-9B77-5CF8C06D4478}.exeC:\Windows\{93F4BA9E-259D-44f6-9B77-5CF8C06D4478}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3034043E-E2F6-4e81-B716-52E599394C5C}.exeC:\Windows\{3034043E-E2F6-4e81-B716-52E599394C5C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B04B61BC-8A3B-4044-A231-B00FD367CCCC}.exeC:\Windows\{B04B61BC-8A3B-4044-A231-B00FD367CCCC}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E2DB68C4-0B62-40d3-8690-25832DE82BDC}.exeC:\Windows\{E2DB68C4-0B62-40d3-8690-25832DE82BDC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC6A3DCC-2BFA-476b-9C8C-FC00B8A9B968}.exeC:\Windows\{EC6A3DCC-2BFA-476b-9C8C-FC00B8A9B968}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FC227BBA-3B28-45fc-92A1-5DB5739F7DA6}.exeC:\Windows\{FC227BBA-3B28-45fc-92A1-5DB5739F7DA6}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C2EA0D33-664B-4553-82E2-786C1E1E9F08}.exeC:\Windows\{C2EA0D33-664B-4553-82E2-786C1E1E9F08}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC227~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC6A3~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E2DB6~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B04B6~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{30340~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93F4B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA466~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35A48~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E2DD~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32050~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{398A0~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD58ba8eecee1738ac71c8badb8ad60323a
SHA118aa7a21310b632baafc38a4c4d61f332065d4ea
SHA2563a2044ec86acb68d1e9af38da88760e93471456a78348c9551bad8cbbff98705
SHA512a044f04e2641cf2338ce27a11d59f8bd24868a6ae54c41612b32fffcb7b4b8e61c78a49e17905a3e244bcd41454f9499b1b9f16a355ae7a407b80625230a69e3
-
Filesize
380KB
MD56fe6d774369be36a01149002423a4e35
SHA169249803708e6a2a184e0f79b5707c958473a4b6
SHA25670e663bbeccac775cc68bb2289f73b433caff342c49653c94a24652798c0abbd
SHA512e2a5576cf2d1862e75e1bb982ab48734ebbd7761aabea9864278f146b21f42454355102fbe1bb869f77e6214638ad9af85bd5750881b346d5a375ff9d2b1d108
-
Filesize
380KB
MD56e1f3187caaae734c31b41314b1c086c
SHA1a5971f2705434c676b33e0554efc048437f09d7e
SHA256b23cef55b86485140f89519c4a6e1fa9b78a4ca4a9a166b31a52e5efcba401ef
SHA512834622070287e2be6ebd9c9eb977656bfb8430695b0acadbb589eab5b15f34d9e9427f0b52fa0fe08851f5dc0d8e8594ff9abbe7f6712c3bbd5aea05fb435553
-
Filesize
380KB
MD54972490bccbf78240ae7e4e323e49051
SHA1c77eba17125dbdb737a48c36d55324a18aed4a04
SHA2567e912cb8558bd5c2c11b1c1afb9519e0ae0a95b78eb02ef1c884243239b0ca2e
SHA512162919597c145a976b0f237dcea3429839e6be682a364f65b0ac01c42645964c8f78cb284c9a6ca7ed3e230c3cefdf45551e9b26ed157de49e9cc90128ca4292
-
Filesize
380KB
MD5e686d93808e5e45bfacdd7a889af79b3
SHA1d4cf9d072d488365dd4584108736af1f86f98d5f
SHA2563018a302ae888d024752737ceb100af962b84ed9bd80c534a37beb4c48eba0f0
SHA51208b11122e73e5669665887ac6d611a81538f31b0402bef53ee9d9c4ae606a479e6d42dbd010e6180744df7b5a739fda0b4d2d26c8e7ec01918618c516b2bebfa
-
Filesize
380KB
MD5410ca32ec197a3993589f56d6d0ebdd1
SHA1efaf1a235b6d0ccb95e99b8a225ac385f9c9f732
SHA256bc3c129722e906c162c418a3db4272afee7911d5283ac01636e988231bc87b1a
SHA5127be141a08300dde85e7ede39d94ca189e0f298e9a530c7f2e8a7a39c8c1c4f0284a33b696ac17c74796ece3821505fde7ae81d706b42c125d2d127804945ca24
-
Filesize
380KB
MD541349e69254ea88b1d9d5037b98fa2ea
SHA1d97bd4982f51a13f167aa964f409881a59da0e3f
SHA2569946d8ec4f4a034c7bfc9c44cd9723aab51e5e26be2bc8e24f4b64a76e089b33
SHA512d6c17e92aa6fecc9d4fb9938b2b138917fe674dd6730696a0812aba2c22dee13c8fec056d7272081261a7a4a37a947ca3becc086329bfd65b476e62efb64ccfa
-
Filesize
380KB
MD51e71e472b9782fce43ded76745a2a2f6
SHA1455492cb5e8437b3d891fb48a6d6ea1a13fc5e35
SHA25646d6cc8d195149b5b27b4b7a779c9f4855471b13763d29a9ad0969573a7d6966
SHA51294027c600ec9845f71854d40d005e40a3963c5e5aa3203be487341318ea3f8d54d39d9faff22f64e00db4463f6ec60a48c45159cff20ec4f153855e48dca78c5
-
Filesize
380KB
MD589b9646c6e86f3af33b63b74b80f634d
SHA1d678947a34dd2c08c4f9bec7c51991681dc26c23
SHA25648f190e4c3d5501fd8a7b52c0fbe55d887db4804ead1c2929f430f00c954ed2f
SHA51273bba7357f21a41df674452cbad66fa5c046d830d17342a3329ccabc71e6083a42f2a03fd684c7b128a3fe0a39ef45cda99a8585c0d7903c57e2f5b481aa6187
-
Filesize
380KB
MD5ae9dc27b0913ad6ea13af850eebc5450
SHA1048417555584f705a7260a50708438241150f0e2
SHA256d25aa022ce468ef48f6b32271f5484bcc89bf83ff3194da6b39a8319faa90d62
SHA51261b31254fd852ec8fa67cefffd8b148e7b58c218fa4b1da17945f367bd5d49309c7180f872a26ec76e7a0a91e1990286fb0c5a77667dc09bb36f6032b3896f54
-
Filesize
380KB
MD5e27188d9ef248f7729c72e12c1b16269
SHA18571a4741e8370dbe29b5f6ecdef6052bfa5f0d9
SHA256106b2c07ea74b0ce850d24fb56036bdb62e53457ce852a4f9c7ed4bb0e9e64a9
SHA51224a47ca5f73171df7a7edbe520cc7254a74dde8cc2fd2487a2c413186599cf2a31e7781f04487489ac1472e9c0d1b3690eea7cab6c3f95213604d37ed94ef06c
-
Filesize
380KB
MD5791877b5627375456ab7fd540c96a163
SHA14564d34e99962b393dede5e5d59dcef68f999745
SHA256c992633250b52e6faac575571d6b0afe9f1a29f6363a4cdda4d49a5b85700b57
SHA51207a35c39fd9891d0f64aa7d6affae1d25f0b13c70024f170dcc462861fc2478638214edca4deda48d4281e2fbe752165297ec62d5e4410b62663abd7a63752e8