Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
18/10/2022, 21:35
General
-
Target
0db4df6533bbe4f721a016b59e89c0ed2ab9af0dec7a8200f7f0e83617bf3d9f.iso
-
Size
1.2MB
-
MD5
07f94938347091978c25af1a7f42f72f
-
SHA1
5260230f225ca88e903357e72b2a6e2b2007162d
-
SHA256
0db4df6533bbe4f721a016b59e89c0ed2ab9af0dec7a8200f7f0e83617bf3d9f
-
SHA512
11b17e7474dee868276520be680616b7a3433016dda071d26e65d82b0eab0179e755d91bcaf060a6c5047ff429f159fd4351ffae7c9f5a1cb952990de07fd628
-
SSDEEP
192:NtOIXco/1QY0OXlb3iQbZaEaJT5cC+aRWTwY2TZhYj1HhIUb:Vcodln53HZ/aLWa0MY21YIc
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\0db4df6533bbe4f721a016b59e89c0ed2ab9af0dec7a8200f7f0e83617bf3d9f.iso1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken