Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2022, 16:57 UTC

General

  • Target

    c62675034dd3e82172af129521282099cf3f70f6bf19fe0e0ecc951a89cf58cc.exe

  • Size

    95KB

  • MD5

    82cda6799faac51cf4da7cda88923a1b

  • SHA1

    8f12cf06136deaf8b50292bd8d25d76e00da0682

  • SHA256

    c62675034dd3e82172af129521282099cf3f70f6bf19fe0e0ecc951a89cf58cc

  • SHA512

    240f5cd587f33358816b763662f2df2755ac754c995f5de9076d1ca749e0acda88dd7c514c2801f012aa55ad3f1bc232c0a95fab675268ded232d03ff71566d7

  • SSDEEP

    1536:8wfUj8g+4OXgjNa844zf00QQrF9BUz7DdsMUrmtXJ0at8AmlVcc4IEvDkGzgn:8T8gIsrNA4rF9mjdsMvtX6at8rZ6l

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:620
    • C:\Users\Admin\AppData\Local\Temp\c62675034dd3e82172af129521282099cf3f70f6bf19fe0e0ecc951a89cf58cc.exe
      "C:\Users\Admin\AppData\Local\Temp\c62675034dd3e82172af129521282099cf3f70f6bf19fe0e0ecc951a89cf58cc.exe"
      1⤵
      • Modifies WinLogon for persistence
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2592

    Network

      No results found
    • 93.184.220.29:80
      322 B
      7
    • 93.184.220.29:80
      322 B
      7
    • 204.79.197.200:443
      40 B
      1
    • 8.253.225.254:80
      322 B
      7
    • 8.253.225.254:80
      322 B
      7
    • 209.197.3.8:80
      322 B
      7
    • 20.42.72.131:443
      46 B
      1
    No results found

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/620-176-0x000000000E5C0000-0x000000000E5D9000-memory.dmp

      Filesize

      100KB

    • memory/620-221-0x000000000E6E0000-0x000000000E6F9000-memory.dmp

      Filesize

      100KB

    • memory/620-231-0x000000000E720000-0x000000000E739000-memory.dmp

      Filesize

      100KB

    • memory/620-226-0x000000000E700000-0x000000000E719000-memory.dmp

      Filesize

      100KB

    • memory/620-181-0x000000000E5E0000-0x000000000E5F9000-memory.dmp

      Filesize

      100KB

    • memory/620-141-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/620-146-0x000000000E500000-0x000000000E519000-memory.dmp

      Filesize

      100KB

    • memory/620-151-0x000000000E520000-0x000000000E539000-memory.dmp

      Filesize

      100KB

    • memory/620-156-0x000000000E540000-0x000000000E559000-memory.dmp

      Filesize

      100KB

    • memory/620-161-0x000000000E560000-0x000000000E579000-memory.dmp

      Filesize

      100KB

    • memory/620-166-0x000000000E580000-0x000000000E599000-memory.dmp

      Filesize

      100KB

    • memory/620-171-0x000000000E5A0000-0x000000000E5B9000-memory.dmp

      Filesize

      100KB

    • memory/620-216-0x000000000E6C0000-0x000000000E6D9000-memory.dmp

      Filesize

      100KB

    • memory/620-186-0x000000000E600000-0x000000000E619000-memory.dmp

      Filesize

      100KB

    • memory/620-211-0x000000000E6A0000-0x000000000E6B9000-memory.dmp

      Filesize

      100KB

    • memory/620-191-0x000000000E620000-0x000000000E639000-memory.dmp

      Filesize

      100KB

    • memory/620-196-0x000000000E640000-0x000000000E659000-memory.dmp

      Filesize

      100KB

    • memory/620-201-0x000000000E660000-0x000000000E679000-memory.dmp

      Filesize

      100KB

    • memory/620-206-0x000000000E680000-0x000000000E699000-memory.dmp

      Filesize

      100KB

    • memory/2592-132-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/2592-133-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/2592-136-0x0000000002050000-0x0000000002063000-memory.dmp

      Filesize

      76KB

    • memory/2592-135-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/2592-134-0x0000000002010000-0x0000000002023000-memory.dmp

      Filesize

      76KB

    • memory/2592-232-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.