Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/10/2024, 05:42
General
-
Target
2024-10-10_03a0ec4e9d736a377870b1600d5e71b6_goldeneye.exe
-
Size
168KB
-
MD5
03a0ec4e9d736a377870b1600d5e71b6
-
SHA1
5fe1ae9c8987468ee3d0a59aa722ba0ba64c6687
-
SHA256
58f5af79b6f1c514db5b05d25b75d620b27fa544eb281b1f957a9f131d1c39d2
-
SHA512
3e3558836b18fedb1d107a08aebdaf29e9aaae4fa4944449f02130b9ad75f705a7a9bdad6e38d7411b6b340c4438c068752145bf227b5b8e6222827afa66dc4e
-
SSDEEP
1536:1EGh0oKlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oKlqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-10_03a0ec4e9d736a377870b1600d5e71b6_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-10_03a0ec4e9d736a377870b1600d5e71b6_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{468875FF-9C7D-4749-8CC1-1A676B4ACD8A}.exeC:\Windows\{468875FF-9C7D-4749-8CC1-1A676B4ACD8A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9814D82D-CD6F-4cb0-BC56-01C50718CFB9}.exeC:\Windows\{9814D82D-CD6F-4cb0-BC56-01C50718CFB9}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DEE6F716-2ED0-44dd-B459-61D687A80D37}.exeC:\Windows\{DEE6F716-2ED0-44dd-B459-61D687A80D37}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{074264CC-ADEF-4ee3-8353-571ED656C1A3}.exeC:\Windows\{074264CC-ADEF-4ee3-8353-571ED656C1A3}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{391B3730-3FCB-47fd-A8C6-20569FE91E78}.exeC:\Windows\{391B3730-3FCB-47fd-A8C6-20569FE91E78}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B10697F8-9DCB-4f8f-9F01-4A423AAB5194}.exeC:\Windows\{B10697F8-9DCB-4f8f-9F01-4A423AAB5194}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2B6CEF09-72DF-49a2-BB34-ED07C9284BC0}.exeC:\Windows\{2B6CEF09-72DF-49a2-BB34-ED07C9284BC0}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ABC96476-6AA8-404e-BB25-A8A20472414B}.exeC:\Windows\{ABC96476-6AA8-404e-BB25-A8A20472414B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75683003-5EB8-4e67-A038-DA8587885410}.exeC:\Windows\{75683003-5EB8-4e67-A038-DA8587885410}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{564484EB-AB24-4edd-8819-C89C2AEF498F}.exeC:\Windows\{564484EB-AB24-4edd-8819-C89C2AEF498F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC8BCEE6-76CB-42b6-ADF0-C0E6AC62EAD4}.exeC:\Windows\{AC8BCEE6-76CB-42b6-ADF0-C0E6AC62EAD4}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{80D8438F-6A8F-4f3a-94A0-555EBE96D5C9}.exeC:\Windows\{80D8438F-6A8F-4f3a-94A0-555EBE96D5C9}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC8BC~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56448~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75683~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ABC96~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B6CE~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1069~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{391B3~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07426~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DEE6F~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9814D~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46887~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5e295318cdb4bd172a527d1a81ef3a496
SHA1a84e3ba504b866cf9c55e7dfe5b48d7bb8aa6bda
SHA256ec66a1451d5a4b3b0182cd17e42311d784de6f633a19f0891b8338a5ac1b45bc
SHA51212b1fb1cce0efac1489e16e67077584e1f1cbee1a3c1504aeabe1b968b0a855f07f86c140785e0679e59faf84d051a18b875cab7d8c434aed1bd9ed5c44c4634
-
Filesize
168KB
MD5bd2203c0e8be59ea0bb97b60913e4e2e
SHA174aba3980c63ae9d0abd914f6317c5ba29182712
SHA2566b641ecef42ce9f87022ba6b265d9a819c9c2c1dd75ac79c42a2afa1a051681d
SHA512fb8537602a3e5ef78de7da535c3fa32bb2f7c3695b94172c1c8f8eb3234686ee8e4258b2fde302c74289b3b3c60cd47991f9b29006251fec50f21c934fbf69ec
-
Filesize
168KB
MD5d1a0448249a77fde247da4bed31f828a
SHA1be202c6f2f5ae50b51312e06e467980f0ef004b9
SHA256556245283cfccc99e69c3cad3c77f805e6308617235bd98ee19a08b75ecfa9da
SHA512f5a21b76527b3e1d86659aba9bf4c02810e68b54edbb6b6c9dcd2ffe6189c24a92eb829f906d4ba8cf487f6529a98d5031280fc5ea5cb889d8c6be9be5527573
-
Filesize
168KB
MD5a12de9053802a9c78f7609d5afde7c60
SHA12eda6ddbede46d98280ea3a60ecafd474c7f0e37
SHA256072c9f832dfe8432812a7ed6dfed64456b837ca79935de9f3a2bd38e121c7abe
SHA5128649eb33f1f5ccb374a28b411d71ec6b97e27c2b9f0f6f51de8e0d8c72eb2688140ab1a02f07f7d10fd2f8e4b90b39cc9cdf4f17a73f1053cef9970ec30366bf
-
Filesize
168KB
MD5f1bba183747c849c065552b3c199b741
SHA161ddc0b1749c63f1e556962786d9929436f8e09c
SHA256b4c0630f0106cb76a08ba172509ff2bb7b23df158025bfbf3d51d56d3107de14
SHA512f30f2ed0c41e5450bfa56896b392dad4bc4ce0435fa882441b3c828adb0593ad87181fd8d17c9feffc5dd8aca622272d5966223d1322d5c980991be8feb78447
-
Filesize
168KB
MD5494f8b62931185d1aad1b8bf530f22c1
SHA116357c06e052164ccdbc102182319f12f5b64bfa
SHA256feba207d6060133ddb9523e6d00ecc01ce11d323557f94004b24c6990adee921
SHA5120c5a1e8a9a479012c4c77436e6b2cbe1be36467afe179b12a8f3b9cd4825245db32b3602beaf23822d4d9a512baf1753f50de74a5db6773324798a24d3f5f8d8
-
Filesize
168KB
MD526ff634c24d514ce2a6ab3af981da498
SHA171a7037dea79eeb05b790cdce42d72685213fc21
SHA2566f80b1a75cebe903a63a6874bef3e0da2994fbfe0a888d787b7b7db80ccaf8b3
SHA512a438ca52043f8a31f9ecb0485314656a26c2879149f5449bc147082eb997ace80e9cf0d711e4ec2156b7aaadce8b9d967e6fa8c37c9b91aa1e7c9e8d66b4c2c3
-
Filesize
168KB
MD5ea5c445ebc0cedfcf8e7a251a52b35da
SHA152d0bafde0a72b8534994ec24dc3503ec86d8645
SHA2567a9d9ea509ea6af4b62a883f89e90fd6d75220c03e2846b0347cb29b5ec198ca
SHA512c3a3fd14af662cbac517d3a3d7e68519f6affcdb6e88d98e4df7ff403237011efb1be7be495af3a883e85d2a1e965743f91f988ad6372fcee30ee6fb1a6b02f7
-
Filesize
168KB
MD55eed4e0cd7c86143cbdc128bdfcbe5d6
SHA1ffaa03e31130089cc99da199ab800f73690ac291
SHA256cf2dd69be09723e2ccbb1d79345648b6044997e1399f03ce210a29aeca4d5e6a
SHA512f556cb8ed35bea08c1ca299a5cfdc996627fa71ef2b1a1ac003205275dc714c3780e097b21ff1aea67e4f3f0a80d4b8188476152a7c7cdbed6a2de1f9142c23a
-
Filesize
168KB
MD5cac974a0e314b32c4a71e9d6214ea6b9
SHA1e9621266d5f8ff624e546ff920f61e00d2459048
SHA256467a9cdcc1a3ce644f9f348a6894e90f7ebac9c4d07c29053c2f61916a46fed6
SHA512eccf47281cbd818b258aa357bcb4c9807c6710b154d80ad1a2080ee3fbdf73b76d1380c24dd27bdf2b20efe46479c8e94754ec5331f077f525b591e1472dd290
-
Filesize
168KB
MD5140ec519d8bdcd4e95cae2818e8e0995
SHA1c46a6b846f07fc7eb8206c6e8f595fe0a85e372c
SHA25699d78340471e898d61c0d2f13535f1525cdddb29b0ab9babc737429d1dd3d623
SHA51200e32d09653db9df76a2a704b1b490ed731ba77562718b8734f7e3b8b9e3d9781c54c4100d03f6a31f8126735cc114e30c87a6555c13b1adbbf5b43f292ed1e8
-
Filesize
168KB
MD5e7c84a7fbee72b6c9a01f634224d91ac
SHA1e87dd4e793703ebd803f17f7428b835e8c156009
SHA2562eb1dfd4182661eda8595425f09cd2f6a34d87e92b11d4302f26840d9b02bfe1
SHA512224035dfdefc24788c42d3c2d5e119377452df93ab072e951ca9832e7dfcb8461a4fa5f31a22428678c3b49ea4729a04574bd3d64cf507236b9c34ff7aff80d9