Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
01/10/2022, 23:28
General
-
Target
33ba8270215b91c0279a747f74a447e944c593c00a54ff4642ee0b5b60e6fb32.exe
-
Size
90KB
-
MD5
637a36bc4a6fde6e2df0341b227ab930
-
SHA1
6b68bd01e30db4953887ddd9fc69dd74f819f73e
-
SHA256
33ba8270215b91c0279a747f74a447e944c593c00a54ff4642ee0b5b60e6fb32
-
SHA512
0f9bccd5bcae9e3340700272166da982f7d9b890105e31a90518d720a3a77f19ff4e5efefd871ee9dd033b6aabd30d7d5bc1f1ed6e5b8592823706241de1ee6f
-
SSDEEP
768:WeWGCQxs9kGd96NDkSV2bIXzl4CnTDHGsDf8RUFqoD4bDIsFDBnon+0ACim4p6DU:1WGxs9kGdYk8wO4Cnt8RUyhon5wm4CS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33ba8270215b91c0279a747f74a447e944c593c00a54ff4642ee0b5b60e6fb32.exe"C:\Users\Admin\AppData\Local\Temp\33ba8270215b91c0279a747f74a447e944c593c00a54ff4642ee0b5b60e6fb32.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkeu.exeC:\Windows\SysWOW64\Winkeu.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD57ec1b1881bfeaf4c22373b58e0cf7874
SHA172e74d0192424e4ff7ddceb3e6b7377cb594200e
SHA256f90fedf02b6e4d9fe6c4d69f788f761571a882374721bf12ecd97853872174c3
SHA5124e34ca217584adcab6e5697405e503128289dc16f010aa273f2672b4399a33e145c03790f1450077996aa6ee84343b23a265a57b5f88c8a17948b9c32bd53ab6
-
Filesize
93KB
MD57ec1b1881bfeaf4c22373b58e0cf7874
SHA172e74d0192424e4ff7ddceb3e6b7377cb594200e
SHA256f90fedf02b6e4d9fe6c4d69f788f761571a882374721bf12ecd97853872174c3
SHA5124e34ca217584adcab6e5697405e503128289dc16f010aa273f2672b4399a33e145c03790f1450077996aa6ee84343b23a265a57b5f88c8a17948b9c32bd53ab6