Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
11/10/2022, 19:14
General
-
Target
b5213349c2ce7867fb3d771d98c0aacf03ad4482f6e6b6f79e7259c7446ddd11.exe
-
Size
89KB
-
MD5
0a121ea0be2d3ab35df77f8c267fe503
-
SHA1
8a3005a93c4cf01f52f0380659665fd300324585
-
SHA256
b5213349c2ce7867fb3d771d98c0aacf03ad4482f6e6b6f79e7259c7446ddd11
-
SHA512
2083636438153835b058156bcd7c9f267d36cb2989c934803c3a27e7aaaff30434a9d2dcecde847c3d7346f43b48f49487290e1ff9fcdcd1e1d02c740fc03c73
-
SSDEEP
768:WeWGCQxs9kGd96NDkSV2bIXzl4CnTDHGsDf8RUFqoD4bDIsFDBnoPpFqwQvp6D56:1WGxs9kGdYk8wO4Cnt8RUyhoRFjQvCl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5213349c2ce7867fb3d771d98c0aacf03ad4482f6e6b6f79e7259c7446ddd11.exe"C:\Users\Admin\AppData\Local\Temp\b5213349c2ce7867fb3d771d98c0aacf03ad4482f6e6b6f79e7259c7446ddd11.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkoyg.exeC:\Windows\SysWOW64\Winkoyg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5052c871474bfe1d79bddd1c9ae8f269b
SHA1ad8668d299272976563957e3e95783860de95a18
SHA256f5fc940722c522fa01a791992cb142e35663174f9a3823e8775c440177562aa4
SHA5125d81c7cdee90074ed37e50c623ce4c8f815b7f52cf50f364a2059b007512cbfc3a6b4b1b02d6a58cb279624aff0427d0621e7adc20746a367f185a0c39ebdf5a
-
Filesize
86KB
MD5052c871474bfe1d79bddd1c9ae8f269b
SHA1ad8668d299272976563957e3e95783860de95a18
SHA256f5fc940722c522fa01a791992cb142e35663174f9a3823e8775c440177562aa4
SHA5125d81c7cdee90074ed37e50c623ce4c8f815b7f52cf50f364a2059b007512cbfc3a6b4b1b02d6a58cb279624aff0427d0621e7adc20746a367f185a0c39ebdf5a