Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    41s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 15:46

General

  • Target

    aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8.exe

  • Size

    372KB

  • MD5

    68100f2212f405d18d9cbc5eea486da0

  • SHA1

    9532e0b4f961e0118258e35bc7235a19ed98d300

  • SHA256

    aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8

  • SHA512

    9d97865b4a784a9ae7ee5f8c22956b18b230111ec81a26c5c83f083bb46c83208a26101b7447ce3760ea1ca639794d9936cf300001c80a47e366d5749f6b35b8

  • SSDEEP

    1536:CROM9kCiFHcx3a4Cnu8RbVSho8CS4I4PP6PcvPnyp3aOTotXQK:CRWCi+Cn1VSho8986PcvgKOEtgK

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8.exe
    "C:\Users\Admin\AppData\Local\Temp\aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1696
  • C:\Windows\SysWOW64\Winkodf.exe
    C:\Windows\SysWOW64\Winkodf.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Winkodf.exe

    Filesize

    85KB

    MD5

    ee9cc408e70ac1c688ca72f7adfa6fd6

    SHA1

    970d57be2ccb318328c28440d15205d785bc0d2f

    SHA256

    7f49984f74188ac96edb48c45140a5f0443b2ceb8856ece19ba5e3f1d3ad3368

    SHA512

    51bca72fb8f2c7216cbde442ee76ed8d72f5d1b58798ea1b490b6b8a3853c6c35e5972392ee2348ae1d37738cf5ad1c741d2deadee4b07f4ed3ad51c02dc16ed

  • C:\Windows\SysWOW64\Winkodf.exe

    Filesize

    85KB

    MD5

    ee9cc408e70ac1c688ca72f7adfa6fd6

    SHA1

    970d57be2ccb318328c28440d15205d785bc0d2f

    SHA256

    7f49984f74188ac96edb48c45140a5f0443b2ceb8856ece19ba5e3f1d3ad3368

    SHA512

    51bca72fb8f2c7216cbde442ee76ed8d72f5d1b58798ea1b490b6b8a3853c6c35e5972392ee2348ae1d37738cf5ad1c741d2deadee4b07f4ed3ad51c02dc16ed