Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12/10/2024, 05:15
General
-
Target
2024-10-12_d0f74590cab23dc9c9d284bafc5dce73_goldeneye.exe
-
Size
344KB
-
MD5
d0f74590cab23dc9c9d284bafc5dce73
-
SHA1
0ddd60208833280c4fbafbca6cb519d0539a3c51
-
SHA256
1e6d5b734f29c9163809ae06b6f986a1400f5313227c3cc40af400677ab84d2b
-
SHA512
684e5ccd91ddc669a72bea505c386a8b87b7e6a2d0cce60294b876029efff18fbc38ede734bd261551127a09892fd0ae73157d2c0da5d20fd7e4b5d324053ae2
-
SSDEEP
3072:mEGh0oelEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGAlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_d0f74590cab23dc9c9d284bafc5dce73_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_d0f74590cab23dc9c9d284bafc5dce73_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{14829A6C-255A-48d3-854A-AB1DA27228F7}.exeC:\Windows\{14829A6C-255A-48d3-854A-AB1DA27228F7}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{796BFBBD-C15B-4d92-8279-D2E9F9C9C876}.exeC:\Windows\{796BFBBD-C15B-4d92-8279-D2E9F9C9C876}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{648CF9E4-B5F5-4ca4-A91E-8F51682553EB}.exeC:\Windows\{648CF9E4-B5F5-4ca4-A91E-8F51682553EB}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{27675B8A-14F0-42c5-9229-A368E5555D60}.exeC:\Windows\{27675B8A-14F0-42c5-9229-A368E5555D60}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{65CE8E5A-63BC-4623-B727-C86DCCCECBDC}.exeC:\Windows\{65CE8E5A-63BC-4623-B727-C86DCCCECBDC}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6B98AE12-FD35-4cf1-9A44-CC1768ABC9F6}.exeC:\Windows\{6B98AE12-FD35-4cf1-9A44-CC1768ABC9F6}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{304290EC-EE8F-49c7-9DF7-BEAD19FF6D9D}.exeC:\Windows\{304290EC-EE8F-49c7-9DF7-BEAD19FF6D9D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC582524-AE0D-41de-8DE9-67CCD345B9E2}.exeC:\Windows\{DC582524-AE0D-41de-8DE9-67CCD345B9E2}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{3B8CC53D-57B7-4f01-95B3-03BD780FC698}.exeC:\Windows\{3B8CC53D-57B7-4f01-95B3-03BD780FC698}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{011ACB60-C158-40b7-9763-9577A6CE059E}.exeC:\Windows\{011ACB60-C158-40b7-9763-9577A6CE059E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A36E9D72-D0DE-48b9-8104-700814948D5E}.exeC:\Windows\{A36E9D72-D0DE-48b9-8104-700814948D5E}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{011AC~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B8CC~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC582~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{30429~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B98A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{65CE8~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27675~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{648CF~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{796BF~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14829~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD512fb9892ab07be1f225065cdbe09b266
SHA185c9e9946985fdd590a70be184e454258981ef98
SHA256cef8d1859f59d1dd882e26f549b2e7883154c5a21d4b904da460ffa4fb980f59
SHA51249ecdfb80a2b215261bece27aa6652da61f5954b6497c08daa181ee080a11724677663d0d9a1374636d6bb14527c2c11feba327d27dd72d679b434633ee1aaeb
-
Filesize
344KB
MD5a626b4c781c89b9a6baec47fb6313684
SHA1ce6a801280e507675458d530a6aa470f74f517d4
SHA256c52b1797d8a0befdb51b5382c329986507984097bb8f008b8fa6ac6863429f26
SHA512823aceee3508aba0e7cfb0c804ce9ea08b8be3b09dfac65f4bfd28f0c829a1a4b7145f02595bc2ba0b16b92a718443d8b094100f2d81f319e3facd8b99c260d3
-
Filesize
344KB
MD591a81933aeb405d50b8352fa44e17ae1
SHA1908cb42f476662e6edbdd8c12021bbd6251241bb
SHA25677d328f735497e3debf5dfebbf1b4cee1c4806a665628a15434d93628ef50eff
SHA512f1d8e31f9ecbbb5785ad6aaa7505f3aa81bbcdb45c07c255f6167f960d109c77d1c5d43a0744b156f0e78ad594f7204bf6e7da4e70c6cc23ab57b7388eb825ee
-
Filesize
344KB
MD58aa85d6ccf5badff4094f2811193a4c9
SHA1e3573eb37e287aecd091f05a316db3269fa1d6fe
SHA256293a5daa23377443a4fde685442997196329ab5177d78769a3c24def440f8440
SHA512e7592d6ab6591ee55bd54c98a74745f977c55c3e65841221cf368db5132b4638688204d403b9250abb00bf26ca4e6640cc8061e92568b005113f8685a4bcc3b1
-
Filesize
344KB
MD59bb3df58dbc5a3a41591d7746300c5a0
SHA1bd0a9f7a877b6a7cb9ae539b4a8ee55e5eb06b4f
SHA2561e8f223a7e2730b3ce6dbd9b4ac4b9398fa5a27d3fb456673500b20bd4122d0b
SHA51281363f1b7a1fc9c5df7f5a73d685eaa5f1243ad2199cdbb4ef077138cc5552544b9bdab831689f50032910bd87852a9d1fd2938fc15a573b35c1b3f588f9bd59
-
Filesize
344KB
MD5268184dd80da7376785ee273435450b2
SHA11a756887a167bf37d9946d41af66ac896b3a464f
SHA2561183ae255294a62501ae3c7d8d2a67a09f7b1421e60b12923a997e97e772a850
SHA512b7b279f15fc76a6613b444b33b0638517b91ec3a50f2bf967bc18feca97be31c0c86036c27100ea246520c711e3efa18503e9034d29886ef8c0e3eb55fb9a007
-
Filesize
344KB
MD5b6105ffd98784c5e442d1d4a3454f2ee
SHA176223405ad306150b6d8d4f9340407e35ce40033
SHA2567e186f74a4bb46172b862911a765017f5dfdc3c4f4285d8c9513d3c9e6f32af6
SHA51240dc28d86890d96cbb394b5015b7dd0af4a2e965d660a2a5b3d7bc0f7b889975df6a5d86d98bbda4d016d7e9461921dda727350fe52b5401b647a0980e73bfb2
-
Filesize
344KB
MD5b0106091c0e81bf6b9888e0f6e9b47b5
SHA12d4914d25735141c69c7bde2570c6aeebcc0f839
SHA256a7b215d9848ee785b7c8a868e725466710a93fdb416b2591ca9671547aedddc8
SHA512afe42b518d25e3049d8d71d1923479f6b332a27f14812a64ad7c8217e44908a2cb1e3a52b55054fc7b4372d05eadd2994d7b8b5b15da70a462650a131c4a73b3
-
Filesize
344KB
MD55c53b6746f01b774103b7b6c6b7d30e9
SHA113d640dc3f59fd16d84bc3f150bb5f59a89ba755
SHA256c043c25b87f0e5db6b3b6a56a69965c81450c843003a225161719ef7b5971ec4
SHA5127c9d3b656a9af97ad8a1db4a8995ff793c8b586fb80f611cefecebcc33d14be3cb5d04dc5c618445b644bf47bb15dca0421257342e1e6e393c341430468c2bbb
-
Filesize
344KB
MD58fb4348636eebd656be34f0d99fd1bed
SHA198bdff848388032885f84317fb7f363d54329d4b
SHA256565062ae9e2a4b3e8ce26f9cf39fa9d2bf6cf583fb59f88d73e9764780f6618c
SHA51208b7709093b4cbde34fc49b6bf12a9505e91484141f82ffb5e24f008dc55829af1fec6e1385216c6a56b0923b6c1223981c4beb033dbdc6c36b04c1d82242714
-
Filesize
344KB
MD59c007eee1e15082a9f8200ba9bf1cc71
SHA1087fd3171da3c78474620e0f1bfb6bd647ae76b9
SHA25685992cbf6e81179c245eba3b2d90e996dffe4fe36c42f41dd81e8aa01c48ec1f
SHA512c6fa3d4e342cdd077d752c0305553272f9a5e81acd171b12ed1a795075eb38f91eb35f47a105f2a8c01e83d89ebf8a5f8fd2aca2fe8037d266c4c09531b0d199