Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14/10/2024, 20:29
General
-
Target
2024-10-14_a46f44d83e516aa5529d86db755e7cb9_goldeneye.exe
-
Size
408KB
-
MD5
a46f44d83e516aa5529d86db755e7cb9
-
SHA1
2fd83e95faa1195d2c08831c5b1415340be09992
-
SHA256
cc987d9a18ddedd0deb8081a0cde8127753e982ef3ed2df8674f8e6eb07f1b9b
-
SHA512
847ab4fffb1f412b3b00a32d5233b4c22ecf80f53f11afdc65ea0704bb40ccc68fc14b38190862d45845d56171c48aec1c3ccb7b14b1e78b5eb65e237a8df6f2
-
SSDEEP
3072:CEGh0oAl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG2ldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-14_a46f44d83e516aa5529d86db755e7cb9_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-14_a46f44d83e516aa5529d86db755e7cb9_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2B9903DA-8024-4d9f-A80B-2533DF82E0B3}.exeC:\Windows\{2B9903DA-8024-4d9f-A80B-2533DF82E0B3}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1F995F3F-3042-42dd-8D3D-B71944E4F24E}.exeC:\Windows\{1F995F3F-3042-42dd-8D3D-B71944E4F24E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{233827EE-BA44-4956-8262-C702DAE336B4}.exeC:\Windows\{233827EE-BA44-4956-8262-C702DAE336B4}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{561B4E9D-7DFA-4d91-941E-4104C6DDE31B}.exeC:\Windows\{561B4E9D-7DFA-4d91-941E-4104C6DDE31B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8F037BC1-1D02-4c07-8611-F673A3DA7A9B}.exeC:\Windows\{8F037BC1-1D02-4c07-8611-F673A3DA7A9B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F7C2CEE-3117-4e87-993E-81F47AC762DC}.exeC:\Windows\{9F7C2CEE-3117-4e87-993E-81F47AC762DC}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{567ED056-5AB0-42c5-A27D-D8B9E3198E01}.exeC:\Windows\{567ED056-5AB0-42c5-A27D-D8B9E3198E01}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4C5C8C6-0227-4a36-93C5-A1B5231BFDE1}.exeC:\Windows\{A4C5C8C6-0227-4a36-93C5-A1B5231BFDE1}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03B2DB92-0C58-4c91-A193-FDA094253342}.exeC:\Windows\{03B2DB92-0C58-4c91-A193-FDA094253342}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB85A9DF-AB56-4dd7-8033-A858A6B7A901}.exeC:\Windows\{FB85A9DF-AB56-4dd7-8033-A858A6B7A901}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{49C6FA54-1508-40fc-8B22-7903B645994C}.exeC:\Windows\{49C6FA54-1508-40fc-8B22-7903B645994C}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{34A2E9EC-7805-4a81-A9EA-5B87814302FF}.exeC:\Windows\{34A2E9EC-7805-4a81-A9EA-5B87814302FF}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49C6F~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB85A~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03B2D~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4C5C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{567ED~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F7C2~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8F037~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{561B4~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{23382~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F995~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B990~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5ae9f8684381c2a6d05c08a67b41660b7
SHA1761997b2eda8809a7df0a6f470105e89708b1ee4
SHA256142374b12ab7175ee236560b03821c61e230541567a1a06ab2d58e6742202cb1
SHA512d90907678d57a8945844d0f94cff296f2ce5cd6c8a721a3da34a03455dbddad6a8af195dfe75c98b411996f2366429c9ea31ed9e2832c6b9474e698ba8480f1d
-
Filesize
408KB
MD58931ee96135fc4402afbd4e728ea4aba
SHA157fcd939a39493c7677ace135cb59834c4c96a8a
SHA256e8e41f1db038022291a7fb4dbc02005069b0e66cc0c945ac1a5be6ac6958f3d3
SHA512552e43f08a31d7113f83f5aa4d113aa4828e03b41c8404b7e27d5d0b384b654a87bedf609643f0218ecf94532030a5e419d10b31e2e2e516b3101ec904a7825f
-
Filesize
408KB
MD59dd3a15c4697b681f870844d4804765f
SHA1093292a95189db6341bac30e2f736deac19d7f8b
SHA25672a4da6586fc2d07a090039c043e4cacee64fb8b842f58608134b14153cf9a86
SHA5125cf118c086a62cc9be366bb49e2b01707ea19ce275bb5242279f6cc15db3a1c541698b82b09a07087a7537c2fc149896e9e38457e70aac8a291e165ef16158d3
-
Filesize
408KB
MD5f7c7c334f679c8b09adccee581995280
SHA18026f6d37b4bc04aedd896388753317845323663
SHA2565c45094995b8155bebce5a894d66439d0baf510ffbc1cc3328ef158c9228b393
SHA51201d35d247fc12dd1ba9341e62650223f84c27bd7ff0889da1a55f62639f09ce7e61f1ec86b8f420fbd3e3e70b8a3725c0ecd46f19af3dd61f0adba79ab34db36
-
Filesize
408KB
MD51d97d57a95a6fac17ef6fc053c9bf99c
SHA158ab10b499ae3e50fee00117e62cec6201b14f83
SHA2567b4787df624bf07506df3f095e27a4138adb1b799fe51c6458fd644e4852192b
SHA5128595b3114529761589b36267ac0ffcc847f7a82ac18e7a34634ec86ce7b3b597070ab1ab12eaef20ea0a6e4656e8c8526fe81960a532e7238a415ed72fdf9108
-
Filesize
408KB
MD57cde6160f12aab9280a342194b17b237
SHA1eb3e12de5d7ca3cfa5d7ddd0e2f368849eacbb20
SHA256d5b69ab33022f1117a997b327a8d2d0f3a4af6f46779c733b69554ae6a765c72
SHA5124446352324cc42773b731f42b39f0319e2ce824005bef83cd6edda752ee5b4d26c791c927cc3b5b0a87ff414f02d671c24fe8e9be995b4d0f23c9d80362d02a2
-
Filesize
408KB
MD5e4e6058dbb58d0ebe22f5963c2ed4c89
SHA1ff0951f99a018bd48ffabd64da525547df69079e
SHA256c7024cd284aa9cfcc988b77d546ec8446045f6d535ed50288c394ddf26362fd2
SHA512eedab7a78f59a8fb1ff3460f27cce673686a8d9628552312c5c0a7c0b0ca4af194cef0ed88f07c4cdccc1011b096de7618bd75d63c2bd203e1e3df9deef7ab69
-
Filesize
408KB
MD58363878103d0229371221d70ea450974
SHA1ada9124aaf150da91620e95e4802ebdb99adc6bc
SHA25648dbfccb18bf5a20ca9147c91812dfd2c9a1574a0d3edf8693640db3b83479fd
SHA5124b9bf5244884384ea6d6cc8b0061d8c60ccf03f4b69920324f0b27bc8c5201631e660b71b167a0fb609558641f9051acda4d922c94c53fcd05f2e4359e99e2e4
-
Filesize
408KB
MD54626fe97e0eef704f4d1fe2ccc887f81
SHA18d1809f30e47522c22cc25a0391e26f30145f312
SHA256f36d9c7d7ce588bcb401f2888d8c3bdf6c0373a315994e9383d4706bda31893f
SHA5125c2f001288c0b9c5aab9a09eeefbeac429ae09eaa1fe466d6019756020c6138878f226129377c08a78a55a3536dd4d8435383293f818efbd72914237c570b14d
-
Filesize
408KB
MD5c1a7585d685f15c6f2c5372edb6658cc
SHA1aad7f34fd88c0cd2e68757b4c0f6fe474c474f71
SHA256bf41b1219399ab6efd6d1405000507176135d823f02a11acf51992e38ddd71fd
SHA512d278d44db23c097f2aaa660ec36dc541530b1e619025ea2752d3859783a1e4ff48a183e302c45853b4d5d0bba36f59ef918fe528bb503af18dddbd39b6e71b32
-
Filesize
408KB
MD55790d5e68e1d98cc2829e268217b84ed
SHA1d88d94fafd6ca9c0153b2df18dddb70f346e5614
SHA256f410d31a7c73c725f417adc82fa750c4fd7c04e6110a1cec976bf5053b11be2b
SHA5127f78f18cab7221595c4a2a20121689135753de404aa95b5353afdfa805e70239da77f2a4695273da85eabfeda4dded490b475cba9d9ad8dbd851a452f4fb9b82
-
Filesize
408KB
MD5f77f477228d7fad3c8e6cde5cec2e0f9
SHA17a4957a67a2f94508184b9263b3eba661f9d57e9
SHA256ef737d7edc02744c3bae7ea93ebcfd217faa9f08297230b3d1ec1540b8cada46
SHA5122354ee7336d7ec43e54af33549d830554036489141e9c780a090bee01d804192e88106c3f1c0ed71467e7cc6c63f87039c056b7d608421571c08e5fa1e33d90a