Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
03/10/2022, 15:46
General
-
Target
aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8.exe
-
Size
372KB
-
MD5
68100f2212f405d18d9cbc5eea486da0
-
SHA1
9532e0b4f961e0118258e35bc7235a19ed98d300
-
SHA256
aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8
-
SHA512
9d97865b4a784a9ae7ee5f8c22956b18b230111ec81a26c5c83f083bb46c83208a26101b7447ce3760ea1ca639794d9936cf300001c80a47e366d5749f6b35b8
-
SSDEEP
1536:CROM9kCiFHcx3a4Cnu8RbVSho8CS4I4PP6PcvPnyp3aOTotXQK:CRWCi+Cn1VSho8986PcvgKOEtgK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8.exe"C:\Users\Admin\AppData\Local\Temp\aa31a69fa0f9b0198ae07d53292b69c319dc405c7679e1bb24a3ea0569e5e9e8.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkwp.exeC:\Windows\SysWOW64\Winkwp.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD533d9b2bb97ebf4697205a2626a4612d4
SHA184a8b5fd4025c3d032cc3fb14377aaae34c870b9
SHA2560f8540f6da55d7ced748efa6978285d09085b4f9815a494505e4d0e1d50e98bb
SHA5127f07335ae648aea758d51fde13b950db9c656984bdb8a8f77cbb593d488680842797674de1b71b1afd1bb42fe3429a0c4835a1c71494612346d67a873678e2ed
-
Filesize
90KB
MD533d9b2bb97ebf4697205a2626a4612d4
SHA184a8b5fd4025c3d032cc3fb14377aaae34c870b9
SHA2560f8540f6da55d7ced748efa6978285d09085b4f9815a494505e4d0e1d50e98bb
SHA5127f07335ae648aea758d51fde13b950db9c656984bdb8a8f77cbb593d488680842797674de1b71b1afd1bb42fe3429a0c4835a1c71494612346d67a873678e2ed