Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
03/10/2022, 15:46
General
-
Target
aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8.exe
-
Size
372KB
-
MD5
68100f2212f405d18d9cbc5eea486da0
-
SHA1
9532e0b4f961e0118258e35bc7235a19ed98d300
-
SHA256
aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8
-
SHA512
9d97865b4a784a9ae7ee5f8c22956b18b230111ec81a26c5c83f083bb46c83208a26101b7447ce3760ea1ca639794d9936cf300001c80a47e366d5749f6b35b8
-
SSDEEP
1536:CROM9kCiFHcx3a4Cnu8RbVSho8CS4I4PP6PcvPnyp3aOTotXQK:CRWCi+Cn1VSho8986PcvgKOEtgK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8.exe"C:\Users\Admin\AppData\Local\Temp\aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkodf.exeC:\Windows\SysWOW64\Winkodf.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD5ee9cc408e70ac1c688ca72f7adfa6fd6
SHA1970d57be2ccb318328c28440d15205d785bc0d2f
SHA2567f49984f74188ac96edb48c45140a5f0443b2ceb8856ece19ba5e3f1d3ad3368
SHA51251bca72fb8f2c7216cbde442ee76ed8d72f5d1b58798ea1b490b6b8a3853c6c35e5972392ee2348ae1d37738cf5ad1c741d2deadee4b07f4ed3ad51c02dc16ed
-
Filesize
85KB
MD5ee9cc408e70ac1c688ca72f7adfa6fd6
SHA1970d57be2ccb318328c28440d15205d785bc0d2f
SHA2567f49984f74188ac96edb48c45140a5f0443b2ceb8856ece19ba5e3f1d3ad3368
SHA51251bca72fb8f2c7216cbde442ee76ed8d72f5d1b58798ea1b490b6b8a3853c6c35e5972392ee2348ae1d37738cf5ad1c741d2deadee4b07f4ed3ad51c02dc16ed