Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09/10/2024, 14:07
General
-
Target
2024-10-09_59a7cad49562e96f37763b21331008f3_goldeneye.exe
-
Size
408KB
-
MD5
59a7cad49562e96f37763b21331008f3
-
SHA1
22b1ce74c5949d4c0e93281bf81394dbd980b5ef
-
SHA256
1071dc1e1f3e842fe93982096869a185b700646b9ae076dd401b76bf27bb8157
-
SHA512
b54a9130e89e1dac839e29ec7e17dda39bb434b9df0b352445005dc1e4ac2276caa1cbabb8843520ae2a98a186eb2603adfdb508c11e9d8bf8c7b29c71b87ef4
-
SSDEEP
3072:CEGh0oml3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG0ldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-09_59a7cad49562e96f37763b21331008f3_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-09_59a7cad49562e96f37763b21331008f3_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5310998B-6560-41d2-B0C9-12DD10DCA288}.exeC:\Windows\{5310998B-6560-41d2-B0C9-12DD10DCA288}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E15E72A8-4039-44d8-9FAC-C5B0DAA9947C}.exeC:\Windows\{E15E72A8-4039-44d8-9FAC-C5B0DAA9947C}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E8B5777-EABE-4f22-95CE-26C596A7DF86}.exeC:\Windows\{4E8B5777-EABE-4f22-95CE-26C596A7DF86}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7BAECA52-74BB-4f50-A07E-B782334DD891}.exeC:\Windows\{7BAECA52-74BB-4f50-A07E-B782334DD891}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{21055217-3C06-4f06-B1B7-FEC0FF860090}.exeC:\Windows\{21055217-3C06-4f06-B1B7-FEC0FF860090}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5AFD12CB-81BF-4447-B64D-5D3C5FD99035}.exeC:\Windows\{5AFD12CB-81BF-4447-B64D-5D3C5FD99035}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{051D7314-9891-4e55-A20B-41CDF267569D}.exeC:\Windows\{051D7314-9891-4e55-A20B-41CDF267569D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F9489FAD-8143-4c4b-93D9-F434461FAA06}.exeC:\Windows\{F9489FAD-8143-4c4b-93D9-F434461FAA06}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C3D44BA3-B52A-4236-885C-981194619D36}.exeC:\Windows\{C3D44BA3-B52A-4236-885C-981194619D36}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F5ED6F22-8E19-4dd4-88D4-9A9BDC35AE6C}.exeC:\Windows\{F5ED6F22-8E19-4dd4-88D4-9A9BDC35AE6C}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CE557DE6-E5D1-4851-820D-9EC52FCDB821}.exeC:\Windows\{CE557DE6-E5D1-4851-820D-9EC52FCDB821}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{00FA93D3-7AFA-4e67-AC19-699D471D329F}.exeC:\Windows\{00FA93D3-7AFA-4e67-AC19-699D471D329F}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CE557~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5ED6~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3D44~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F9489~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{051D7~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5AFD1~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21055~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7BAEC~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E8B5~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E15E7~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53109~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5c0b68ba83956106a87016d7489149aac
SHA1054a2d3384ba9ba3c1bd10b7ab19aea729739b0e
SHA25657e7a64875b9e2ae44e377e33a3ce3bec0af15ef18fc97f1e71ba7c9d0bb02c9
SHA512b7401889e99a6067345b32e3a9505095fdda82a7d986037a2c60d211a1341fb9e3838eb1e9d7d564bcd54f14e233689600bdf5b7c3460fa9064ceaa22c451b72
-
Filesize
408KB
MD5853493547e06b8d66f77e8ec34a83d42
SHA1fedbda3353f65857718c56fa25756e1908480ebc
SHA25641f6fba4e03c4063c13b28ab1817109904d88b94ec11f209305250be8ab6dae2
SHA512b53eed86dda7e137ab7a2dd67fa1b1a5e3e728dcb8b1ea6cfcc95b5a0aae727ea732ae8795230f6e471bbea009b02815b6e03840c5ac50f31e7dd4d56e7a49f8
-
Filesize
408KB
MD54be4402b31d37bb09e262a13102e6e54
SHA1420480ea5d47bf31e723d0f77e51102c705ed85b
SHA256212af012fe58c7ae43a031fc11c27856215890f3425e6b357bc4d7958b895250
SHA512d8f407622c3ae2aa77296c8ff89e58ff09c9c8fbff64c4a6f5044321f64d42a3ddfd4293a1df918d463c21e57400205da2b0cade195f704deffffa0f6d513f58
-
Filesize
408KB
MD5bbbafa5ed194538df817d61b5959c407
SHA1929436afa044fbead63ac0d2517be8bb6b618f93
SHA2565fcaaa50c1c26c528174dc68dd569c23371e331fb0c21dcaef85510543ab3d9b
SHA512f8d9bb1eb317436eedd16db6876dd2095138dd4f14ac495f439a02dbc56410e7ed7c66c4aa6828235d36fe033953f193912c300a846cd5290b1c3f08f542c20a
-
Filesize
408KB
MD5bae349689066837e92b7fd4535b0dfb6
SHA14fd2cbcc7a4e77058270dc113fc40ead1a093592
SHA256fffd11cb4b81ff1f611181c85b95060b7213178f3d03284693e6bfc5963177f8
SHA5128ae4f0198f7cb59359ff62bce2fa5d7fca9930629bdf530531ca8d7ca93dccf3f342e38109cae264afb574aa04d44a49e876250b1991f32d839a14cfed6dff47
-
Filesize
408KB
MD55b2d0174fe189ef2c71ff498eb69dde3
SHA161bd4794ff43dba949b837eb1e2a761bde6ee9af
SHA256da0a736d6addae69208dfc818083439e27aa8e1988b2f10e363353bdf18f1fe1
SHA512e95b7a045e99faf61bb53501287a7dc39c5db585cb4bc435d2e24ea14b5676680376a34d5056d47a7afbc7df70631bad7b7ca8628522a0c496628feb52f0816b
-
Filesize
408KB
MD5b338f15f3eff14bea34740b910406726
SHA17cd8a09396bde12e4002901b429d197c4e1abe42
SHA256b44a64f3a02fa1ac3fb0a2ca333d196dd46c076252a26ede5114d0615925d515
SHA512994f8cd4176f8e2d4dbf81933c765df617b67ccff90592b28a8ba5d737c31a6febc831a876ad719fa363e9fd0875bd050022ab5159a0dbfacd03e634a52309b8
-
Filesize
408KB
MD51eed605ccc111355d8cdf91cd7a641a5
SHA132fc76d36c744d119a6c6babcd240ed9c6947671
SHA256ecf969e82f7d62e63927ad4b8d66397023cb96ece3b828c619bcd4d525026207
SHA5127122f45775ea0c719b9b9c9c290b70cfe6ba551631af518902f3d44a000ae5093034df932e87b11504813d8dc7e17ecc045f48e3856210a9622b1eebd4bdf66c
-
Filesize
408KB
MD5487b2f7ba88b65f7875e37e28354c2b6
SHA18bb4e489377437a67b3846d7acbba5ffb195c303
SHA2569e40e27cce07c6fecab3e9817992f29fde3dfec3b7fb6393515385d2fa7c13b5
SHA5123945363a095ebe93ec7adc43943f3fa23075ba7d89c70dc743d5d68fa4fe20b8857eca631e75afe44da3e8157ab7efc863af27e982d73f0a046cdfda1c2e0350
-
Filesize
408KB
MD5f72af1b535238b827620f8432d287487
SHA19a425d0e2fcaa3c7391b5caf415b0076183d5236
SHA2567ef00f3ce58d6e412bb697b9bb826b48f0d7e2ca6f95db76c33184a1a1ab2196
SHA51221956e011891ed893cf269f21b9383ee6570172b3523f5cd4bd2e1106afac419cbf53d96caae3f10a13ba0b4d759d35205406dd8a60fcc7c107bae8a7637b965
-
Filesize
408KB
MD511a9a0dda9bced590a76aa5371553848
SHA1001b70d62aae59cee3be54a372381eed029f2633
SHA256016fbef592cfc4b106f53f8f2157ae4404e08b31fb99554e1ad217bb4de7b5d1
SHA5129518d30729ca12ffb2abd2d605b627f566a265d20f849e19d808401d91cb53c42c1aff3eb4357f6682ae71bb29a2eb5ac7b73c681e2a5293934982b35d018bda
-
Filesize
408KB
MD52afe89659af85e95b37458437058fde2
SHA1921bbc838991529bd5d24ab9c50dd8fd8687b7b9
SHA2569e3b81fed2af54aa71e7bb971d16123cbc4082c82bd87ff898ba27e793b32809
SHA51227799307f93d1866c3d79a06a460aa236749ed834f06c55079041936f6f5fee6240f3c332d305832a3cd754d21961978d14223e2c38acf5817562f1377f3062a