Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/10/2024, 09:31
General
-
Target
2024-10-18_426316c95b133a7d838ef64aba9491ea_goldeneye.exe
-
Size
344KB
-
MD5
426316c95b133a7d838ef64aba9491ea
-
SHA1
9f572e18549967acedf4fb3edb2059024a50d793
-
SHA256
4ccd2b8f150b501e556c8fb6a88414b5085d6e8b2686b52bfc188f6ea710c38e
-
SHA512
ad215540698474fec6d122d2c03f6142318f495a31b9c9d27558b3d93e7b0d7d674ea7ff90b3378e873e956d8de7efbf706efbb2196c186c599cc1a6bbad8042
-
SSDEEP
3072:mEGh0oIlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGGlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-18_426316c95b133a7d838ef64aba9491ea_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-18_426316c95b133a7d838ef64aba9491ea_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1F5140B8-D1B5-4f22-9AC8-BE901AA3972D}.exeC:\Windows\{1F5140B8-D1B5-4f22-9AC8-BE901AA3972D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1F3544ED-ABEC-49c4-82D2-9C018F6E9D96}.exeC:\Windows\{1F3544ED-ABEC-49c4-82D2-9C018F6E9D96}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B78C9BB1-B5F4-44ea-9F4B-C0E31B4B619A}.exeC:\Windows\{B78C9BB1-B5F4-44ea-9F4B-C0E31B4B619A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{71328A27-EC4B-46d3-B393-0A42E17F81B4}.exeC:\Windows\{71328A27-EC4B-46d3-B393-0A42E17F81B4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F0C7B86F-9B97-4a39-929E-A7ED48A1F460}.exeC:\Windows\{F0C7B86F-9B97-4a39-929E-A7ED48A1F460}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC2A2473-6A50-4604-A6F0-793FEA8C5CBB}.exeC:\Windows\{CC2A2473-6A50-4604-A6F0-793FEA8C5CBB}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{06D4AAF4-F2E8-4586-B289-4099C036D418}.exeC:\Windows\{06D4AAF4-F2E8-4586-B289-4099C036D418}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B16D02B7-5A94-4f83-8F3C-49779DFAD760}.exeC:\Windows\{B16D02B7-5A94-4f83-8F3C-49779DFAD760}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FF040857-E46C-4d81-8FCA-F739FC9CAFA5}.exeC:\Windows\{FF040857-E46C-4d81-8FCA-F739FC9CAFA5}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{09DD08D3-32E3-4d8d-B219-165FEDBE443E}.exeC:\Windows\{09DD08D3-32E3-4d8d-B219-165FEDBE443E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4445DF5-370C-45d8-94B2-778B263D5911}.exeC:\Windows\{A4445DF5-370C-45d8-94B2-778B263D5911}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{6D53ABAE-5780-4a84-B4C2-6B6F54A81178}.exeC:\Windows\{6D53ABAE-5780-4a84-B4C2-6B6F54A81178}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4445~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09DD0~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FF040~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B16D0~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{06D4A~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC2A2~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0C7B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71328~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B78C9~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F354~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F514~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD56fc498d6d83d4bacaf5ab35441d35c4b
SHA10c21225f516787fec15a01b5ede6a3990c50145b
SHA2569bcb349b802f5758c699c5533b8294fd94064428338f98e4befc2a5ed6bb73d0
SHA5124a5d8c895485e78e757bac94e00c5aa72befc15e9d97dfcf0fad623528d6207195db205f7b6e4330e8a670af63b9de21788e14d8e72066e62560338a073aee5c
-
Filesize
344KB
MD5bd7f2111eda8b09ca475de63029be4b7
SHA1e1edc27f00e187a71f7af1a64be27c7ace567d80
SHA256a3e28a810eaa3370324c8e7e60d1cf3438f81d525ee2fef79fdd03151b09f874
SHA5126a342a96c3b9ab29b0b6a1759d4d0a468445e19ebff06cd5d79c0b35d406a86ca6c0b1c6f8627525a86f11e84975e5dbbf7c92c130e502534dc0feb2294ee8f3
-
Filesize
344KB
MD52c28f3f37e66b34d1cffb0c69ba92b20
SHA17be7b110883255306348bc9c93cfaa35e0a77792
SHA256a9fbf0db02d05c71fa222f3b4694469aa84e6829efb3ff5eb8bcd41fe71963c5
SHA5125b41e7a7824545d89349c4d3990c5b5873fa62e2ee7c391c53371d4ebe0087d6949862909dbc38a08cd95358e418d474ef7dc693f8717f68d1444c07a3750b94
-
Filesize
344KB
MD5e792404cde07081be3cd25b14aac30ac
SHA1c054eac37df34705e1a381ea5ad0381c373e00ee
SHA256ca1d0878bf53ed34bdea443261aec77be3920c5be5d8bbaa554a9ff95968cd47
SHA512ecb6eea376d59d602b74a73ecaa3d7882e937f524f523ec935506c702fd75988123f4c32a918280f1cb724d8fa817d85360b36011d2eca4ef0030c7db1dc6e3d
-
Filesize
344KB
MD57d58cfdfe0ad538eb76744ffd3df49c5
SHA19e9644c9f55d6ec22897a6ca125dcee3cd00778c
SHA2564a16468d4c2e31ed28711250ce891b3353d24a9ea8a37844d7409f924cdf03dd
SHA512d7bbfc7d1f67cf6d24fedd6bf2a21f246fe799f699a606bdedd405fe8eb9fc324ab10dfccf01564773e1c24335561790204c429f6989beb979e590ca5882069b
-
Filesize
344KB
MD5f3e06bd042f96262009f5c7de609c6bf
SHA1b4b775fce1a5b83741af89cace3151f04c41f239
SHA256c8e599c7c20546666ce9ff83c799649d65e104059643313be1597bba3ed5e49a
SHA512c399d7bb71724043beb512487def99c967633cdaf1ee0513ff3ac327922e0f008dadb6f8000fe6a7d5d1d7b6c87d2174acd589aa4cc845d6d0cc6f18dc3feb9a
-
Filesize
344KB
MD5c6c61d644fdb4c0171c4c46a1e7ba530
SHA1702947e999cc8551c823fff5ae608c4f97e9dd54
SHA25645ed4b8bf9fef21002d73ce8c290ad69c185a2b7d0b09809880dc4a0555902ca
SHA512f950a81f4272eaa03b507e33ba647bf09380491f79c0c35e1d4b85c697abd1d34097cb75ce88982a4b509ac1451297b90a1ed2e814cdd18febd07615261c8f63
-
Filesize
344KB
MD5f1ea059e686c3a9029290a6ce42949a9
SHA14e8a96e3a2969fd33c16a27eb60d1bff9d30faa0
SHA256c5ce0d732bacfd9b61ba22cc9ad880e748ad7bf7e9a7f41edb939e633a276b85
SHA5121758508d008f2e4c167c93c201205976e91c6324891262b58966e663229c2bc3e3d256cb0776184b9a6ef394346f8f5f499f0ddb7d928265bb7f9624d88ff0d8
-
Filesize
344KB
MD542bace168928d4cab9dc52417ecfbf06
SHA115a26ff9c9ba32eea9df989c05482bc68b1f2126
SHA2560cc897985f10cc65379e640f12602210fac78e3b2d62cbc8a6dee2cb6fea3ce8
SHA512937a237d64dfeefd566979f9c25245047c5d31ac4e56787a31a19e29330540bc7b1ed0ef703f8985391435f7500444956e891f8f413804320efb28e88519102f
-
Filesize
344KB
MD5bd08337d0f0dce2ed08d89ce7bfc7501
SHA178f1c90f16d8b2094387e7aa6fcad762d2066f02
SHA256074e1f97ab46c015bdf500f56a2df89099b87b04517f2758d588566604c51326
SHA512990811548d604f7cf69b76ccb031dd2bf05e623639954827a55399ea84dd5f7c299af24bd595f98bbb782c0df7645aaed90520c4aecb1dbf084c300be1b385c8
-
Filesize
344KB
MD5488b31c45c5c72b4629527a22c32b63f
SHA1cea1f2fdec72bb51c548f97313bc13d689499f3d
SHA256cde8c61ece1c33d0735ca879fc55e30dc718f081c4e7101c229227e628f69790
SHA5128eeffbd69c5db02dee30a18a3f34b588467622f3862411b7cb9b3a52213f46a36974308c412aee0e5675aa676e57586777b7c83c374f357223b66508f497965a
-
Filesize
344KB
MD5a277a52fd732b481cf3300738e37432a
SHA1c2cc6a28d25d82ccbd4b91a19f4ed078ea22c50a
SHA256d059855ac6365665c089aaf067839b2f689d3d89c61f6b7fd02f8418edaab0ab
SHA512923f69020ca3ea9bbd5ce1374db4a39b7801dceb4ab30b1b2b3c47c32936f7143482f1d1eb58ce0dc8f3975c48b95daa7a814f1967d1dcd52c8728fa0859400c