Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13/10/2024, 17:19
General
-
Target
2024-10-13_ddf66f847efb952dfc45da6bb0019ce3_goldeneye.exe
-
Size
192KB
-
MD5
ddf66f847efb952dfc45da6bb0019ce3
-
SHA1
525915ef98b50cc33373264c7789f53a7b939400
-
SHA256
5496e8b82db8c3dcb9c9ec696e95cee1e44b64b858dde2e4982edc88c744d5cd
-
SHA512
9e763f7a4d0a1555b55203f1ab52f79d8a9677bfc819005ed2910347aee93c9a76d1d4bdbf52ad97c61c65628d5143f69e6531e0dc923ada9349f15ab16817c1
-
SSDEEP
1536:1EGh0oel15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oel1OPOe2MUVg3Ve+rXfMUa
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-13_ddf66f847efb952dfc45da6bb0019ce3_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-13_ddf66f847efb952dfc45da6bb0019ce3_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76051115-3D04-402f-86F9-2D1C89055EBD}.exeC:\Windows\{76051115-3D04-402f-86F9-2D1C89055EBD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDE4114A-2C1B-46d5-B0D0-1A59E84E7641}.exeC:\Windows\{CDE4114A-2C1B-46d5-B0D0-1A59E84E7641}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{42087136-BB36-4e5c-9CC0-44D256926B69}.exeC:\Windows\{42087136-BB36-4e5c-9CC0-44D256926B69}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EEA27A81-CD54-40bc-B39C-7F983EC6F7E6}.exeC:\Windows\{EEA27A81-CD54-40bc-B39C-7F983EC6F7E6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7B6184E6-EFF4-43a7-A08B-9EF787A7A581}.exeC:\Windows\{7B6184E6-EFF4-43a7-A08B-9EF787A7A581}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8B4D63A9-20A9-42bf-8923-662B858452DC}.exeC:\Windows\{8B4D63A9-20A9-42bf-8923-662B858452DC}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9CE3F4B3-0648-4930-A143-2DCF67DF0B82}.exeC:\Windows\{9CE3F4B3-0648-4930-A143-2DCF67DF0B82}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F6AE5E4-AA5A-4ff5-B17C-6421B2CA10C7}.exeC:\Windows\{2F6AE5E4-AA5A-4ff5-B17C-6421B2CA10C7}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{02C90935-01BD-45ad-A249-8BDC9F6C13EF}.exeC:\Windows\{02C90935-01BD-45ad-A249-8BDC9F6C13EF}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B859EE4D-7BD5-4eae-9C5C-9578E07D74EB}.exeC:\Windows\{B859EE4D-7BD5-4eae-9C5C-9578E07D74EB}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{0D1FB228-206D-4a68-A426-2463787473FA}.exeC:\Windows\{0D1FB228-206D-4a68-A426-2463787473FA}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B859E~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02C90~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F6AE~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9CE3F~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B4D6~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7B618~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EEA27~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42087~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDE41~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76051~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5377dc32cf72e406dc197cf418cfcf0e8
SHA1cca3ee244af45dc73ec75d2bdaaeae462e0f6437
SHA256a2707104212b7356ba08e93628c30b29d7f8a4a45489b54cd6c5fe784a68848a
SHA512a4ceb773d740b517e60c67f05cab4c0f2f3820d511a1d30ac7435730a796a13f50a5463fcae04aecbe8ea74daf679205aeae353071674f8bb209e1cc1efca7dc
-
Filesize
192KB
MD5472b6be84d84df1f76706af0b041a2ce
SHA100647fddcdae38beb01d143b44b1b8f69f13870b
SHA256a80b86a6fa7c1a90d594dd4ce7040e0c5dd5843034fc58ba6936d80b7b5e2f29
SHA512ae30d6aea0df951edbc4987ee7c9ad9665d1c65c9ff7a7b704b92914f4c3be66a913cfbd0aa857ac9bf687ac5b30d6ca49862fb131dc33c04d19d54c36d64587
-
Filesize
192KB
MD58340ed8f5404ea1c794c330ffdbec9ae
SHA13dddab02a5e4f57271eb71b398537421cc4d6aca
SHA2567adf245f290a92a7f5896d32a1f6556f4d43a2f313a451e2feaa4e2527a6c5f3
SHA512908fef47840261d7a8a1db1adcefb0a5c788c62eaff384298b2d14d21361bc60eb497d79324f33d18f20cffe6d8c0506879536f1be95c2e852553a7bdacc4db3
-
Filesize
192KB
MD57a6315e1e623f1905726afe887b24e0f
SHA1d615d368fe86639987963d2b282b7df3ac463edc
SHA256dbfcf8c8eeec7dcfd189667b4d30d104d5ac49bd44fa83f14a032e2f4f425006
SHA51237166fac21d4b470e6072a1f24fa1d4be39061ca68fcf9b4a66421981423301228a1604c4f3041bd767fa9b7c1162106878b51d9263a4bd1f358cc6389d29561
-
Filesize
192KB
MD5bbfb67576afedfdebfeac8e66368f283
SHA187986f1c11eedddefc58cd0820672802709f94d5
SHA2567df36b6c1a9a46d24256c8f1f18d2088d17e720e3f9cab4a6786ee5f53f690ca
SHA5122b80aa8bb6e9deb1cb56270d516477bd18485441693a7dfdc93c9a0b9af574b2a8a4df9e609ecfda1367839762bac43c0077b5795c5fb96b0a2af7f9adf79a10
-
Filesize
192KB
MD5c678f9895425684ddf8fabac649b22c3
SHA1ba0ad78bc994d36a1ea2cb76fc83f507cee8ce97
SHA256b9fb7f1173aadb28aab0d47576f0137de9d93147a74af27029f1c95a6ea59ce2
SHA5124d5ea1d8b53ef908da4d59a5982353f599aa57a280f56e4aec97852b34fa1a909ce945f0db2da5e45e49215cf3ef7da6d04ff33ec91f901bddc852cf1005405d
-
Filesize
192KB
MD50d1464348d61d9663dfd263890d95a57
SHA1a6d16458529333d9095d92ed932515f80ce9e13c
SHA256c3b53c071ef1413d8dec47c3cf83002a2aa44fdee0650a7ea7db4a07776b151d
SHA512fd777871b6b4127681d1a4c4ecff6b8c0f20046158cb6fbef354f81727757c8533cfe63c52def86681841bc47588b2b11ce48ee2ba2b7fcb9e5df73556c8e940
-
Filesize
192KB
MD57901a9c97b041a41b066de33b5847dba
SHA1d549fe1467643face386ab0e0c058e851f6e4440
SHA256b9ae762100707dd2c75f1a08bac5a5d768a23487df5d1ff5ad50a1ffd1283a38
SHA512237e1dd3a45aed210f597149ed211d6cd9e8a6186e24927461be904e1fb5267449a7a1b63c06d975ec464eaa1e4a646622239974692a5eaaf45a8bb52a00b086
-
Filesize
192KB
MD5079dce179b9cba6fa113e6ace3aff41f
SHA15e828d3e689b0b4bc65b1c7ef6bc47fc6f82c767
SHA256d2dba3149fe05b9b7b89895a76d85c04be73ace78c05e4d498a1c4ea42462173
SHA512469cb2aeafdec484c9b6602f8398ca90f481d2cd9a099a0ae85df28f587db8ffaef27afbc07505a4e39bdfdcde4e6b3c9bfc45bcc936da4d6dfea33ad02bfec9
-
Filesize
192KB
MD5cf6274b0565d2f39651255fd5d243a62
SHA195fce61203ef6c267b12fc443790f7149c32a2c0
SHA2562ca0b39ccd2f0f2bc950f3fb4856d808a10be41fda3090b0a9334227a095087c
SHA512391fdb6fb35ec85b821daef5f6cd63794d086d89d4934bfb835b511a2ea88a6ef18e6fc3ea89602077290954763537cca0ff7817aa9b14f9b28e3c12b8daea8d
-
Filesize
192KB
MD5c2fc5630623a45684f51b598885750ed
SHA15f87c31fc37442f474dce5a0a41c683176d6f8c4
SHA2567065af005d32e3503787e68ba8bdff00588434a18dafb9c96733f6754644b70b
SHA512801c9819995a762355dc510d6c61d25879e21890db710299347c536aaf5caa58c339719668078d3f553d909b04b8b01868bc328e5f6d6af2fbd45fc3d02fb3bb