Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/10/2024, 05:42
General
-
Target
2024-10-10_1214e16331e699f2f27c568dde9c3c80_goldeneye.exe
-
Size
216KB
-
MD5
1214e16331e699f2f27c568dde9c3c80
-
SHA1
78751462d4a0abd3b5711e5f7e5ce1d990d1d1f4
-
SHA256
b264be4b8195c6118bf8e8ab002d2ed99eca502f7ddd03963b32c29ccb6ec4ea
-
SHA512
955b544cbdaad767c565fc3995dd822df594ea36c48b817a68a156e30cd3fd744363150278e694d2a9b4c9438610980c22da2aaa68dc21f14bf4211d3a10abce
-
SSDEEP
3072:jEGh0owl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGOlEeKcAEcGy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-10_1214e16331e699f2f27c568dde9c3c80_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-10_1214e16331e699f2f27c568dde9c3c80_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6917855A-01A2-4a0b-9659-426FBF3518A1}.exeC:\Windows\{6917855A-01A2-4a0b-9659-426FBF3518A1}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{191F1D38-58D0-494a-9C47-D671912272E9}.exeC:\Windows\{191F1D38-58D0-494a-9C47-D671912272E9}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{00C65760-C060-4db3-A839-40DDAD73EEDF}.exeC:\Windows\{00C65760-C060-4db3-A839-40DDAD73EEDF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B3374CD-1830-4abd-B627-12F1B095ABC9}.exeC:\Windows\{4B3374CD-1830-4abd-B627-12F1B095ABC9}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A37C21EB-AF28-405a-8A13-AC73EBF97EA6}.exeC:\Windows\{A37C21EB-AF28-405a-8A13-AC73EBF97EA6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B565ABFB-103D-45b7-AB50-13962F3E49A9}.exeC:\Windows\{B565ABFB-103D-45b7-AB50-13962F3E49A9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{633D0C06-EF77-4f2a-8E97-77F92916CFE9}.exeC:\Windows\{633D0C06-EF77-4f2a-8E97-77F92916CFE9}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E78416F8-93B4-4ce0-91F2-6B88FA55184B}.exeC:\Windows\{E78416F8-93B4-4ce0-91F2-6B88FA55184B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FBA3EFCF-9A08-4359-B2D6-CADACEA2A6C7}.exeC:\Windows\{FBA3EFCF-9A08-4359-B2D6-CADACEA2A6C7}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CF99EC54-CDAC-49e1-9184-90707FFE10C8}.exeC:\Windows\{CF99EC54-CDAC-49e1-9184-90707FFE10C8}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{386F565B-6B4D-4aa5-8A09-A61DDA846E6C}.exeC:\Windows\{386F565B-6B4D-4aa5-8A09-A61DDA846E6C}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{CBD230B8-9765-497e-A62B-13344C605542}.exeC:\Windows\{CBD230B8-9765-497e-A62B-13344C605542}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{386F5~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CF99E~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FBA3E~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E7841~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{633D0~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B565A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A37C2~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B337~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{00C65~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{191F1~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69178~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD58590edd5352be5609281a68d9ff28d8b
SHA15a745e056541c38b634bf13d22a54170f56c06b4
SHA2564fed74e0003dce2feadb85846fe9af044da1e1589f4e64124fb4d9438ce68bf4
SHA5127063cde1b24f4f30602c71862ac4511133e1e2916010ba01a893081334c0593d089646b7cf08f02778ea4b3e982d648e2dc3bb6569ca9bd9e8b026105ec0afd0
-
Filesize
216KB
MD55ef7e1f5210a83d339dbfada424ed21f
SHA1bb73d12da4b650c8b5cbda42d204a7b66e5e0971
SHA2568ba731ef3e2a87dd2db0646c9c064cf7863e10cdf3c44958008e7767b7f54d25
SHA512d223154e5f329f0d544842941bafcc627514e90444ce2a81477db96bf4f979a414bc7ddaf480a271f5e1086b952d1f4e563c9d6242d6306bd2d692982dd43a54
-
Filesize
216KB
MD509a62d2137108ad8f33b0f7ff49df681
SHA1b89cee9545c861e609cc9740d1958157d8f2feb0
SHA256d21ebc43acc3097152628fbd6f004bacc4637cfaa175ffad5542a57349760c8d
SHA512472a75ada2553ffad02a3426eef9bff23b6c1df11bd12db478cfdb6ce7396a9ed00c3efb12cc4188daca325af8bb3e4117c65bcd86101bb469ebf736f1efa0cd
-
Filesize
216KB
MD52331742059715b877a8863b99978fab0
SHA123730fc9f613a73d56946a3d56f1dfa2ab934a45
SHA256bf34cd67dcf2140e9beb837cc19a188a6e304c611687128bf995c464167265db
SHA512270274908726fb92592b021df5a3ccd879895de6106154dc0af483b444ac1d26c7b999bf800413c7ffb91db112e740d0bb6f841e0d041c501ee6a8a2be256149
-
Filesize
216KB
MD58904f4f05d3c521dafbd097c7f4b285e
SHA15eb0a54a2f3ad29f0404d82bd7133942fdc12d74
SHA2562205b4b7b766014b04198d0b822516e62e72dadb04a28dc64365cd293a9c605f
SHA512b04ecbb1bf0e4da35cde068de130e569b9211bd683196765df691d19c4e7defd711365fa3034036f4b289426f8c86edd7de405deefc0401a6cdd62fd9f15497c
-
Filesize
216KB
MD5f276dc906e04e6774dd68e95feac8f8f
SHA11077a954d88bb91316b76b65dd467aae8c5e19f2
SHA25645875a5730ec5ca8c55a0b1aa5dfa19b238c844a32e8b6f79f31196e5e30ff22
SHA512d3e133e5958c143d985f47c805bf9ff18212d320614fdee7b33011632f09f866a0c0df06fce36749702e6f113bcbfd95501745ccba632ba50599e6a3e3e30ad5
-
Filesize
216KB
MD5e6e52618eef2036a35ca0c96375085e3
SHA1cfe86e9e977f2559f94c3ed74a2b42c388168797
SHA25697cc1870084b1472933d99887ba060441990231cbfe9c119540642de82817c09
SHA512ed42f034cf235262e3657a2cf3cef80c81d8fa0517ed2408d726a19d9b43fb4a266a41f3fbcdc89204918071708329bf73a2c2ac895a469cdb9f399d146592ea
-
Filesize
216KB
MD5cb2088dc37f57b5414e17e80624ddb30
SHA1f820a00372207f45751c4607b87126f2441885ee
SHA2563ef18aef5305f2e01f2bb26f2aa1c895e89943a222dfd0615128fd4bcb600686
SHA512f3c689656cad696d12380470e8fc2f5261473bc5b17abdb311e4e3c1bfaf6650f78c758f00dda7d0e8b5094654b0a9f9987d9c0a69e55c4df58b677dd0f19d58
-
Filesize
216KB
MD5f2381aa5c5f7cc74be05eea608c9d910
SHA1221bc4d036959223b0e674cf6c7ac6361a870d5f
SHA256cc15d2954377a76ef97bb172ce2c930c24f3ef86ea258f4a814935353c63a1b4
SHA5127b082c865e5748007c989dc40acf083ff10e48f568679b14c98eeb1f822d8c7c1f3a5bf3009de5069e636a889fae1316550f3f17ddde992f0058af2376b02588
-
Filesize
216KB
MD5aa2c15938c24c1e70ce670c6e3e8e708
SHA1d5555fce82847f6efdd9cfd28da4b8a2f0ad60e9
SHA2563a8be106220b27955efbc8333c867760639b634cf011e068de83f1963d4ae4fc
SHA5127009ba00f3b6ac907a70564eb320d02227a0dffe5d2a5e4327c72a85aa45a89f306bd3eef80f488a4a9a333ccb136cd61d915cb43293a5b16f32f4505abb0544
-
Filesize
216KB
MD5401d399ede957ea393fcb82520941f74
SHA1e9ef6cd993493a781da60f59428ae0c838e41185
SHA256e7d749c5e694428d548fcdc618f897e470937eeb8aac1ed401f006853dcec689
SHA51276c1fc66e1f167e67a7c1ac76d1c437f4d9353e65d70203cddc1ff177030a7b127c37de456bc420faca80b0b97cd21f9fcc719097eb006311bdd21d8890796cb
-
Filesize
216KB
MD5094444e006e80ca5f61a648f281cbdd4
SHA1ce57e7a76c5405cf77745b1337f3bc3414f90c65
SHA256585965ccd9c7aee9b5f549ea92549a249523dbc052db9bc9f68db0be662264ae
SHA512d3debfe55d725b17721fabf3a89d421f250ae033f8b38519db4400aa5223a841025e0082c00cb4bae9d6eda2c627348424ee5d4433b48aa859789515207ffd5e