Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    13s
  • max time network
    20s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 04:50

Errors

Reason
Machine shutdown

General

  • Target

    cb8c51c9a8ce7a957640a2b33a95a08f2936055834170394176dd3d079ea0172.exe

  • Size

    84KB

  • MD5

    7c8d0f74f6d2f1b0f1d40a120d9efbae

  • SHA1

    a7ee2d41e61eec5ca946193bb548899de7c604b9

  • SHA256

    cb8c51c9a8ce7a957640a2b33a95a08f2936055834170394176dd3d079ea0172

  • SHA512

    19f9d8f39e1e966e4f5a9e37f52915b92d17c7d0b4dac9946c86b765a8d67375c8bf1c7b5abd488aea3393aed1a3ea104252f1040e24681e84d93084fe59fb4c

  • SSDEEP

    1536:+oikayYALqYRz3Lz7qr/ntwuGON+uD5mdpEUeOA5eU3zM3RwLxrkC9gtYoWoht5z:1GERz7qr/nllUuDYRHky3WCT5I9LHoB

Score
8/10

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
  • Drops file in System32 directory 1 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb8c51c9a8ce7a957640a2b33a95a08f2936055834170394176dd3d079ea0172.exe
    "C:\Users\Admin\AppData\Local\Temp\cb8c51c9a8ce7a957640a2b33a95a08f2936055834170394176dd3d079ea0172.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1180
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa39f1855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1256

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1180-132-0x0000000001000000-0x0000000001016000-memory.dmp

    Filesize

    88KB

  • memory/1180-133-0x0000000001000000-0x0000000001016000-memory.dmp

    Filesize

    88KB