Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09/10/2024, 14:15
General
-
Target
2024-10-09_978ab126b431bb83919a3bff477b9433_goldeneye.exe
-
Size
344KB
-
MD5
978ab126b431bb83919a3bff477b9433
-
SHA1
ed385f772ab23bede85e42c8206b378913ba7e89
-
SHA256
1f3017ebc849abe639130cf9d65c3ffd8bc52575face57e0047337f39e0ddfc0
-
SHA512
cb6121643e2245a6df7be0c15897a3f91850525f7cd1d0bf7c2b07d6dfed94f38d6c9ce4acf7d12f88fedc4daa4998d22a7fc351da403c5eab91e8e900172830
-
SSDEEP
3072:mEGh0ohlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGblqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-09_978ab126b431bb83919a3bff477b9433_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-09_978ab126b431bb83919a3bff477b9433_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CE4AAE50-0569-418d-8067-6C9C357FE1C7}.exeC:\Windows\{CE4AAE50-0569-418d-8067-6C9C357FE1C7}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{102DF3AC-96D6-41aa-9EF3-9A6B9FA87EA5}.exeC:\Windows\{102DF3AC-96D6-41aa-9EF3-9A6B9FA87EA5}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F452F9E0-66C4-4bf4-B79C-D6E390B44A94}.exeC:\Windows\{F452F9E0-66C4-4bf4-B79C-D6E390B44A94}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{89E564A6-72FA-41e4-B4F7-50AABE48F46D}.exeC:\Windows\{89E564A6-72FA-41e4-B4F7-50AABE48F46D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA76CBF7-8632-4169-A545-4631988ABAF0}.exeC:\Windows\{AA76CBF7-8632-4169-A545-4631988ABAF0}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB3797B0-C137-4143-85B1-63A4DBA3EA22}.exeC:\Windows\{AB3797B0-C137-4143-85B1-63A4DBA3EA22}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15DBBA29-8FF6-42fd-97CA-58AFE0038C12}.exeC:\Windows\{15DBBA29-8FF6-42fd-97CA-58AFE0038C12}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8238357D-5C47-4be8-BF32-354A335752EA}.exeC:\Windows\{8238357D-5C47-4be8-BF32-354A335752EA}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3CD175B5-1CB4-479b-9C4A-B5496EE1066C}.exeC:\Windows\{3CD175B5-1CB4-479b-9C4A-B5496EE1066C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1AA57206-06D8-4a29-BFA3-AF3C577EAC5F}.exeC:\Windows\{1AA57206-06D8-4a29-BFA3-AF3C577EAC5F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA4FCEE9-09D5-4410-89B8-ED259453D46E}.exeC:\Windows\{FA4FCEE9-09D5-4410-89B8-ED259453D46E}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F01C05A4-9405-4ff1-81B8-AA617DEF5EB6}.exeC:\Windows\{F01C05A4-9405-4ff1-81B8-AA617DEF5EB6}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA4FC~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1AA57~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3CD17~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82383~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15DBB~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB379~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA76C~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89E56~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F452F~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{102DF~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CE4AA~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD57a37f5d6aa6801b36ed73aa89bd4c8ef
SHA1a105eda09bc20541897fb3fed65de5db98ba8020
SHA256c2e5e4af43eac3f90dfd103ef1bdc570ed548eec3942dfd1134e6306a4e375b3
SHA512f6ebefcd9c5dddc8fc3c5d8d8b2e7d085da597c5bd97e21a8e55aca3b15cfb9ab137fbc1a0757e143e943870f0f73cf274f5c74604fb5abecb792cbccabead13
-
Filesize
344KB
MD5488422fcd05e004861b02c6475f2ff46
SHA19c4003df76e3c4fa029b5b92f1d7a48eee0cf11a
SHA256851fd5cd9ef03f7696c2a2fc5f6df587bed62bcb912c2df4426d94917d45e41d
SHA51255f8ce38c7ce51875d6c518aafb198097cf96ce45712c2458a0603d22e2def755c27b1944ee956d47d42fae8e82f460d24a1259a831f0d85d383f3d5d5078707
-
Filesize
344KB
MD5cf0aa22e942814149511d9e2c33646fc
SHA10e2a37de42e0cb0dccaa11a536cbfcdb1a449d6b
SHA2569abe8b4c4db6f08d2b3af16a3d824a0e06fe7d4d14066f6786f70b02e4b42383
SHA512792f00f841f06d02a75ec672bf37bb53a46aef785c61f8bf3accd06b4c4c047311e7bb531362d1021f4a84377132a98afc0740ae7254a80b73ceea35339dd723
-
Filesize
344KB
MD53bd000b61fe99400a6d63e4e2e80fb58
SHA16cfd79787af088edaddf0b9233ff5ea28e4d2fc0
SHA256cd090e58e86c48a704faca35e9ec19fd3733458fcb3eb57ecd023236ff3f8b5e
SHA512f0f0ee30a2c254cb63271b08d6cb04175d09b70d46d2f23ca7155c1665fdad545debd43ea2c8c87f6d547ce7f3803a6aa378ca8ee7be4f2c58473a6b1912b48d
-
Filesize
344KB
MD513faefad8974d9e34cf79ec62826cb60
SHA10e1977e982a7bb9db6abf354a543ae8fbb6fa0a2
SHA256e232a2336b400b6fdcefedba45163b07fbdcfd85f531df8ce266f492b7d1ff47
SHA51276071a649f7fbedc5f075649be8a338a56bb4ef615065552fd946497de15a15830d23bd83acbce07f9df9ce7a65ac31e1a5556db89a00b3b73ae9fe934a8a208
-
Filesize
344KB
MD575b8e3261359ff4a930b17a698740539
SHA12530bd568b7f25b745edc91f64f706df662c732c
SHA2565944be7d6cfad974bf16fd9cc122f144beed9f0999a5737c6926b5a7fba7cf33
SHA512c541897f5075a671fa1edf1f35332cde95eacdb5c94416ab5145ff1c164bd79c25d6c3278e29b394f21c9d2f83354ca60ba2458558e88c9a5d3556e5219c3a76
-
Filesize
344KB
MD5f889a5e19b8afe982b655a292e4922d5
SHA1bca58284d65fdc78c0c0c9a316c6cb126f47a786
SHA2564186ffd608731ddf58a3d9c6c7bf09159cf9f9b0eb877e3b825479dff4a0ed0c
SHA5124f802cd085b5fd2e95e64cb46bd9b49fe9aee6d465c2a1598ce258f490a5577435f10884ae1496ad4bb2492f5c6e711170ee08ecf09492008a89df9b97966ab5
-
Filesize
344KB
MD53b9fa7fd8e6c0bcb875681e1c544dfb1
SHA1d753cb8a030515317a53b2badb29c22d5277f0d3
SHA2561cfefe5a222c62673348813c80eede3811a4752b8e78983f91e94cff65a27f10
SHA5126ebbc868f9e5dc3252b66c2bd7d5b5dc0c4a51f0b50180434ca5bbdc482bb2de205facc01eb431611d5df81eb036035f68e1d2bd44bd7dd98b62ff4a6db83da1
-
Filesize
344KB
MD512491ff226f54d780b9e42a8f20a14a1
SHA1f28e2ec5801b7c56faccb0224eacc8480ab0855a
SHA256ad52ff666707a3558743af1fd0f017c5b17063803cf2dba2939bdcffe3669a4f
SHA5125178611cd02f0cb2512771845ee8c6c5cd1abaf716d8ce89601133c08cb0bf80f740d14f09ce9f7fad84b61222b8103f19f8dfa8bfe3c7b8efdeb59d5f065982
-
Filesize
344KB
MD5c8697dbf6aa1abdbd617d172ad876a5b
SHA1f6acfd39744dc53517b127e8fc65af1788cd4253
SHA2566682def01c13fae98ab4fa12c186590cea12c4ff7a51c5521c3a9ce2e9aa31a6
SHA5120d0f5918c6ddb55f094421176f8a71e012016279c88155f7f0879d35ca14340ffc99c185698cd3911009c6a54743367155f4a1f169f1e9f98b09b3f626bc9689
-
Filesize
344KB
MD51a2f7257c11180113ef97f7f408b1e47
SHA19588bb281cec2902d9cd0052227c922672e2d856
SHA2566386550a5d980db830fdf943d27b3900ac86be7f82f5553f4ffa27bdb7cf84b3
SHA512f43eeb5d428cd38310db5743bc2ff05fb61651c7e2f0ddebb8d4cd5294d865ddadb15654234b790fb321538489a45971fa67964b51f74a680cb9d04e20b51702
-
Filesize
344KB
MD5bf827965ceba428b2486057e209fcca4
SHA11845115ba799863ef065f3965094dcfbcd228a02
SHA256b8feacf668c457fde660473d66d29b0b93f94d31a4831aec4a350dcfcedca50a
SHA512c17b3a520933c4ac6833051ab34d7b36246c65638af6ed9d00e00028197d8f98413060f485a9514583b357177dd8f41ae79b087b97482ad22195d81c7a18bdb8