Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

df3e94bc12...ca.exe

windows7-x64

8

df3e94bc12...ca.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    134s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 22:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    df3e94bc12450741394dbc6eb4bdcadda010b3c595c42c39f5ff110772b003ca.exe

  • Size

    40KB

  • MD5

    70db830df85313404765c8f5c2504170

  • SHA1

    2dce39fafb7499cf9b36be482e07e0c43ec1e0ba

  • SHA256

    df3e94bc12450741394dbc6eb4bdcadda010b3c595c42c39f5ff110772b003ca

  • SHA512

    25c979954d5440e38a042ca37108eb95a271d10a2a2521b8896dc552951242a07a1747de043e32d0b83ef741c383a1c070ea6f63effb6cf3424b6ba4086e2667

  • SSDEEP

    768:/jz76laptRlWs3zHnH5MY4gxjYNu4v7ragNkzRE5hfFETec0uYNF:/jzTdlWAzHatgxjYM4v7ragNkuETec0j

Score
8/10
discoveryexploit

Malware Config

Signatures

  • Possible privilege escalation attempt 8 IoCs
    exploit
  • Modifies file permissions 1 TTPs 8 IoCs
    discovery
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df3e94bc12450741394dbc6eb4bdcadda010b3c595c42c39f5ff110772b003ca.exe
    "C:\Users\Admin\AppData\Local\Temp\df3e94bc12450741394dbc6eb4bdcadda010b3c595c42c39f5ff110772b003ca.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:552
    • C:\Windows\SysWOW64\takeown.exe
      C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      • Suspicious use of AdjustPrivilegeToken
      PID:4340
    • C:\Windows\SysWOW64\icacls.exe
      C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:4900
    • C:\Windows\SysWOW64\takeown.exe
      C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      • Suspicious use of AdjustPrivilegeToken
      PID:2416
    • C:\Windows\SysWOW64\takeown.exe
      C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      • Suspicious use of AdjustPrivilegeToken
      PID:2028
    • C:\Windows\SysWOW64\icacls.exe
      C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:2084
    • C:\Windows\SysWOW64\takeown.exe
      C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      • Suspicious use of AdjustPrivilegeToken
      PID:5048
    • C:\Windows\SysWOW64\icacls.exe
      C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:2680
    • C:\Windows\SysWOW64\icacls.exe
      C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:2144

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads