Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    84s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 15:46

General

  • Target

    aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8.exe

  • Size

    372KB

  • MD5

    68100f2212f405d18d9cbc5eea486da0

  • SHA1

    9532e0b4f961e0118258e35bc7235a19ed98d300

  • SHA256

    aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8

  • SHA512

    9d97865b4a784a9ae7ee5f8c22956b18b230111ec81a26c5c83f083bb46c83208a26101b7447ce3760ea1ca639794d9936cf300001c80a47e366d5749f6b35b8

  • SSDEEP

    1536:CROM9kCiFHcx3a4Cnu8RbVSho8CS4I4PP6PcvPnyp3aOTotXQK:CRWCi+Cn1VSho8986PcvgKOEtgK

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8.exe
    "C:\Users\Admin\AppData\Local\Temp\aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4388
  • C:\Windows\SysWOW64\Winkwp.exe
    C:\Windows\SysWOW64\Winkwp.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Winkwp.exe

    Filesize

    90KB

    MD5

    33d9b2bb97ebf4697205a2626a4612d4

    SHA1

    84a8b5fd4025c3d032cc3fb14377aaae34c870b9

    SHA256

    0f8540f6da55d7ced748efa6978285d09085b4f9815a494505e4d0e1d50e98bb

    SHA512

    7f07335ae648aea758d51fde13b950db9c656984bdb8a8f77cbb593d488680842797674de1b71b1afd1bb42fe3429a0c4835a1c71494612346d67a873678e2ed

  • C:\Windows\SysWOW64\Winkwp.exe

    Filesize

    90KB

    MD5

    33d9b2bb97ebf4697205a2626a4612d4

    SHA1

    84a8b5fd4025c3d032cc3fb14377aaae34c870b9

    SHA256

    0f8540f6da55d7ced748efa6978285d09085b4f9815a494505e4d0e1d50e98bb

    SHA512

    7f07335ae648aea758d51fde13b950db9c656984bdb8a8f77cbb593d488680842797674de1b71b1afd1bb42fe3429a0c4835a1c71494612346d67a873678e2ed