Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

SecuriteIn...09.exe

windows7_x64

5

SecuriteIn...09.exe

windows10_x64

5

Analysis

  • max time kernel
    74s
  • max time network
    134s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    10/07/2020, 21:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe

  • Size

    21KB

  • MD5

    5df538e080dbe410f614180e895fa655

  • SHA1

    16bb74276eaf9695091befb5f1559893eb10e84e

  • SHA256

    62824d9a353a539053724252d3710008e5894f3580fec8449ec38b7828e7b389

  • SHA512

    fba134ab40cc2de9c27af6d902b27eda6a88bf3caceba53442c36e533197de8d972e4f65b6c954e59fc8990a5047df01496ea8e73573d06afd9139ef31516cf7

Score
5/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 23 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownloaderNET.72.24252.17209.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    PID:3044
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
      2⤵
        PID:3448
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        • Suspicious use of AdjustPrivilegeToken
        PID:3872
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C taskkill /F /PID 3872 && choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3932
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /PID 3872
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3500
          • C:\Windows\SysWOW64\choice.exe
            choice /C Y /N /D Y /T 3
            4⤵
              PID:1940

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3872-0-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB

        Download