Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

64jdustas73sgsf.exe

windows7_x64

1

64jdustas73sgsf.exe

windows10_x64

1

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    09/07/2020, 14:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    64jdustas73sgsf.exe

  • Size

    239KB

  • MD5

    e39b6ba95134fed2ce020e34fce39c38

  • SHA1

    00667af154f422b28af1bf28a62d6ed186186b04

  • SHA256

    ec33d59365a0a4cbc9eca3feeb9007c5590e5ead81c6a8f0c9967a8e93ba5fe2

  • SHA512

    f5f6c722acc08ad9bd1b9bba4bf8e60da309e386b8334da1e7adaf074687643011a347bc4047bd90a90954328a8d0039ad38f2df88dc54b47284eface3bf9fa2

Score
1/10

Malware Config

Signatures

  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Checks whether UAC is enabled 10 IoCs
  • Modifies Internet Explorer settings 1 TTPs 81 IoCs
    adwarespyware
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\64jdustas73sgsf.exe
    "C:\Users\Admin\AppData\Local\Temp\64jdustas73sgsf.exe"
    1⤵
      PID:3844
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      PID:2896
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3136
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      PID:2112
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2544
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      PID:2736
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3932
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      PID:2892
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2892 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1568
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      PID:3688
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3688 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3752

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3844-0-0x00000000007D0000-0x00000000007E7000-memory.dmp

      Filesize

      92KB

      Download