Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
19/10/2022, 23:04
General
-
Target
403daa39886c0f06acd2663416f929b07f185d728bf67abd8424e273dcfddb50.exe
-
Size
171KB
-
MD5
82e49b3a536412fc0ce63bcbab060cef
-
SHA1
553a87bcb033f71c4220e1317ea3d4cc05c27558
-
SHA256
403daa39886c0f06acd2663416f929b07f185d728bf67abd8424e273dcfddb50
-
SHA512
ca78e9868a6234b3ba1d178e45d879b18fb26052ad228a18e6a97002cfcd3b048f30f7993331ecd55705eedbd2c96ad866970759686b8d78fbe07b0791869ab5
-
SSDEEP
1536:TA31uITEB3OxdafOgzS8Wk5VSqm9fe8mn9NdZ66GV8WDF4dhyW0MUwtHR/9HRgwr:TC12+r9mSLkyd92cD6jCMZ9tDPt1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\403daa39886c0f06acd2663416f929b07f185d728bf67abd8424e273dcfddb50.exe"C:\Users\Admin\AppData\Local\Temp\403daa39886c0f06acd2663416f929b07f185d728bf67abd8424e273dcfddb50.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {5E7CD9E2-29A2-4BFA-85E5-7C2A0A00C7A1} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~3\Mozilla\jwufxge.exeC:\PROGRA~3\Mozilla\jwufxge.exe -kqepohf2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
171KB
MD56df6995325aca0035e190e02dd3a4242
SHA1fa9e423e00aa61b57aa97a0df4e8624f45015637
SHA2561856005c0c713d9fb9ac1bbcb603e74eb0bb325d9f37d7b156467350e848b395
SHA5127236a4c3cd07af7466ba5434a2b4e83c0f832424c8363c25e2f2d67ecf2a1260a45d0a45288e980d2448ca0af914dbc101959ac6ba6fb1b6365db2cfcfacb6e5
-
Filesize
171KB
MD56df6995325aca0035e190e02dd3a4242
SHA1fa9e423e00aa61b57aa97a0df4e8624f45015637
SHA2561856005c0c713d9fb9ac1bbcb603e74eb0bb325d9f37d7b156467350e848b395
SHA5127236a4c3cd07af7466ba5434a2b4e83c0f832424c8363c25e2f2d67ecf2a1260a45d0a45288e980d2448ca0af914dbc101959ac6ba6fb1b6365db2cfcfacb6e5
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
8KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB