Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/10/2024, 12:19
General
-
Target
2024-10-17_b9a05f4b65bc36c319367b726f012c8e_goldeneye.exe
-
Size
180KB
-
MD5
b9a05f4b65bc36c319367b726f012c8e
-
SHA1
75a1e3e877c5f03873ce504aa326d0d90cd5dce3
-
SHA256
a1a98a70923dfb2a7ca3a214231913d684a716866ffa8c2651401e960fcac586
-
SHA512
8021774a4e0e480c7b35018752f7928b6c54199f31cd559df20a24241c69e1d4743a14839abfe4fd4f4e268de66c4fcdc914948e4a555fd4100db44f84d17062
-
SSDEEP
3072:jEGh0o7lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG9l5eKcAEc
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-17_b9a05f4b65bc36c319367b726f012c8e_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-17_b9a05f4b65bc36c319367b726f012c8e_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7735A719-639F-4010-9E48-A7D6D9E4FC82}.exeC:\Windows\{7735A719-639F-4010-9E48-A7D6D9E4FC82}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B90D2EF2-077C-4e44-A9E8-84CC796F919A}.exeC:\Windows\{B90D2EF2-077C-4e44-A9E8-84CC796F919A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D3AE0B43-7604-405b-A7FE-1E5C237AA5F9}.exeC:\Windows\{D3AE0B43-7604-405b-A7FE-1E5C237AA5F9}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA564FA6-9901-4789-95A9-839E26EF4597}.exeC:\Windows\{FA564FA6-9901-4789-95A9-839E26EF4597}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EA8DEF7F-8553-4dde-988B-36CB5EFAC51A}.exeC:\Windows\{EA8DEF7F-8553-4dde-988B-36CB5EFAC51A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7943B0A5-885D-4866-ADBC-EFCE8C3072D3}.exeC:\Windows\{7943B0A5-885D-4866-ADBC-EFCE8C3072D3}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3B50BB36-EA45-40b3-9B12-E266A3F94AC7}.exeC:\Windows\{3B50BB36-EA45-40b3-9B12-E266A3F94AC7}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2B8A8FE5-286E-4a8f-9C7B-0620786C347A}.exeC:\Windows\{2B8A8FE5-286E-4a8f-9C7B-0620786C347A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CB885DEA-F401-4c99-A7D6-D20EA50AD642}.exeC:\Windows\{CB885DEA-F401-4c99-A7D6-D20EA50AD642}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F7BE7093-331B-4e1b-A41E-5A04BC7A514F}.exeC:\Windows\{F7BE7093-331B-4e1b-A41E-5A04BC7A514F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5CAF15AC-6662-45a6-8628-45961E85C2A0}.exeC:\Windows\{5CAF15AC-6662-45a6-8628-45961E85C2A0}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8CFEC2E7-82B3-4ee8-9B22-AF5DDB69D21B}.exeC:\Windows\{8CFEC2E7-82B3-4ee8-9B22-AF5DDB69D21B}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5CAF1~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7BE7~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB885~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B8A8~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B50B~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7943B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA8DE~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA564~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3AE0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B90D2~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7735A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD513c12c761164f15c304631574d7d5763
SHA13e2481706e68dd006d533ba67b33d352125e3a8c
SHA2567fe073f4e3dc9d918c040afa03b1ef3973b5d1448d888a95730635f7aaa54979
SHA512a5a06b26d6b920ff64d63db695fa7ab004c61903b1e0cc58aaed6d8d567a76ea26b788ac110ad4c99a70efe53cfc374b42a09d29719ac3cd7fac2bbcf08ed228
-
Filesize
180KB
MD55188c1a7bc324c348ff12e0961d66152
SHA12a01d9e41e543e03ee0855893f07e8ac086a1f09
SHA256751c78f4c32ee3f68dcc041e78448aca0efc1d614fce5eef5e55c046bb30ad88
SHA5123c20de868318eaa936389c783a0851e1b3127f5291372311017a353b2091af75a0b63cbc481577659992e0a4690b2f31c6e2d09038ee6dc06f0214ad17c12c2a
-
Filesize
180KB
MD5d8075a0e0808a8109756ef50f7405dbc
SHA13c8894d583af82324e88676ea16d551b6db79f17
SHA256fe4b4c3fde5e0c52b4d63d1bcb62463288868448f9f99784decde6f3d297ba37
SHA51216a8a3c0cb465b4e81cb92c242de954e073acf9fd8f3384bda4c177e04d70132d4494f63a76a7de82f6c77beb295c43fd15c1cedafaaf8d01260b08c5ef9c244
-
Filesize
180KB
MD5bdf6cd5a2d838e7ae7f3dc21911aaa25
SHA1e89db4a1af16ada854f9cd35e82c002be317f0ec
SHA2563d66c9a247ee22332be2c75be436bdb203113fc259182129ccabdd67562b4531
SHA51243eb2d8b5ce861e9805d9b152cd08a6cdfa9d04eadb559026338c131e635c009143bf566679a5e9d0fe98aa50c9c7e5c6cbc254351f7db846763de168d5bd2ee
-
Filesize
180KB
MD5c70d891d73129759d61e059726a7e49a
SHA19ece1bceac03ffdc1b92cc3976c90e6eea5601c9
SHA256c40fc77b31d82eba1fd637d1e4f337904edb1c835a8ff7bd2dace6bb12aef6c9
SHA5128cd42cb69e50ecbe34fba5de7dbcaf0b5c059d7a1d7e0c9b9330b1af99821d1d82cefabdff443461acf120012d47701692e8071b7cddbe03d0e3e388b415c1f5
-
Filesize
180KB
MD5aeec6e1112f9b16aee1511144d0a62a5
SHA1382ce68835b0b55cc17e49be10f49f1274e0784b
SHA256c69d9c5c41d2c1c9807ef535738dcde6a6577bf14329f877103a16b1cc14489d
SHA512b37389bdf14b6febbe04cbbd64a59bb683b241981b66fb61919316c20f04a7af9b0aa9adbc1db8bc3302dec01d99ae8f37adc97dcd2b999ece8b8951459e7a4a
-
Filesize
180KB
MD52e455a4a543f145b5ba79d6f8156e1b7
SHA1c79a714307a61ad7b4ad4a281154fdf736dd19be
SHA256c466253be33ea603be602416526cd40f579133060c016e1b5609019dcd06c6ff
SHA512f07981dd259694321ba5607f4b62a7143ff5220e41a4366271b0e607d099dc34acfca52bdf34888312902b4b29a03b24af3e0c1057b92ccf2529be3c6a881603
-
Filesize
180KB
MD57a8ce4a4c436dd17380948889c8d04f8
SHA1a049c93aad76bcb6260685c83db39c39639b17bb
SHA2565892b903a7e02c50423c96cbff6332589504c41566c460b7e6720c93231c18df
SHA512bfd4057720de7d1ade04f735c3477e3756ceb81e34f24adcc02f969b6811b40bda9c98baed12d74377d4f0c57aae8afb3e77af4cd83fa5c492d360946e30b760
-
Filesize
180KB
MD5f0baaf468b5f7e2704e7e2a3f178c232
SHA1a4cd8c697fe7be9656dc32d4d14cc06864472888
SHA2569e38e9af235d1fcb6ae4458b0a29e62a36037ad580d5d53984e57c55e8df6442
SHA5126109ee0dce62588f5de6e465909e5feb6992dd97ecdd14e7aa63f7b49c41ccc77b76486c0f7f1648c617b00b9826048f5c4546f1256a5789d430ac0820ea5759
-
Filesize
180KB
MD5abe33735915b5e3d70d0fc41c299a74f
SHA1beac192a4441fb9b27162d2e54a496aaf66fcb56
SHA2563b59931e0017a32064fad26ac149b8b333fac31270a10c4740a87c7f48685f9a
SHA51271afbe59a0bda56b3464fe77c5fdad9bb02fd82fe38cf7e5ee2f34c9a2cad2d0fe7d9e24dabb2bada5711123696f2ec2313e7445687071354c6ac975e6aeae2f
-
Filesize
180KB
MD58d30452a227c9687d67dec3c1759badb
SHA123fd0116f3505b2f9c6827046f12b28fc2f73a5c
SHA256d6815588e5112d4b2f53234cd5b2bbf217ca8350fbc16ebe017c9235f686ff5e
SHA512843b242f2b2a417ea1c515be9da6c52e974f866420cad734a35a605354081ea94b1b7a10fa7c7a84db843b529d8cd4607d16569a4d281dc4260309ecfeb2b833
-
Filesize
180KB
MD5ae467255db9daa5e76455b26008c55d1
SHA1acbee633f5d1c74eba0757acf96364ef9f1d2cc3
SHA2567d4fc86211f4fe4caa21da9a36269fa55857d3fbf6fbed1ed2bd1f92dc97007f
SHA512d62210dd49619bfe3e5c10502424560f7a54e18aa6b895a51dc37efef5a2da08276dbb5b05c06501264ccf5d0b32af5f4e3d9f34f541dd319fcbf83f6c5f2870