Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    161s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2022, 22:01

General

  • Target

    f1d5e99465d30a49df0df1855fc8982c893829b895d767120abab24f2642c58e.exe

  • Size

    760KB

  • MD5

    65feaf516852831a2e0cd62930e4d890

  • SHA1

    93ee37e6d04c6c1dc34cf24b8101bae904d07d2d

  • SHA256

    f1d5e99465d30a49df0df1855fc8982c893829b895d767120abab24f2642c58e

  • SHA512

    74ea6edfb414f79e249ef023e6a0d7b775747390ca1042b9f3e0bcecccfa4a7802f20f14c5ee188db2b3d61c452cc033cb9fc284ab0f29aa2693dd8b653a76cf

  • SSDEEP

    6144:/aKFVip6wM4AfNrUq76cLdAfgfb3TlwFEoSpWaK+lIZNVh42xrYGIWT:6MwMx2qKgjDlc6p1viDBd

Score
9/10

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1d5e99465d30a49df0df1855fc8982c893829b895d767120abab24f2642c58e.exe
    "C:\Users\Admin\AppData\Local\Temp\f1d5e99465d30a49df0df1855fc8982c893829b895d767120abab24f2642c58e.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:852

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/852-134-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/852-133-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/852-135-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/852-136-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/852-138-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/852-140-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/852-139-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/852-141-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/852-142-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/852-143-0x0000000002230000-0x00000000022B7000-memory.dmp

    Filesize

    540KB

  • memory/852-144-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/852-145-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB