Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    182s
  • max time network
    236s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2022, 04:03

General

  • Target

    e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe

  • Size

    449KB

  • MD5

    4ba998ebb14caf9d3abe087a55b3b170

  • SHA1

    cc44fd5bf32dac8fdc59be33ad2d9f38f81dfc3f

  • SHA256

    e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af

  • SHA512

    aefb97df4462bfbe2958f72cbcb8124afe94e02734661e2270fc5968214e11f8888bd7037d0e14f2029154ce9fffc6655b8b657c648ce30d7d0e7d36a4409ff9

  • SSDEEP

    12288:b/kviXzd8sjomWdT0BuGDjgCElxWAufQtuN0H:ldXjFqKuGHeGfQtgM

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe
    "C:\Users\Admin\AppData\Local\Temp\e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4044
    • C:\Users\Admin\AppData\Local\Temp\mbagfrtqqjqcm.exe
      "C:\Users\Admin\AppData\Local\Temp\\mbagfrtqqjqcm.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\mbagfrtqqjqcm.exe

    Filesize

    11KB

    MD5

    cd88b3c711e087e5f2527adddb19902f

    SHA1

    21a979133fb8ba30d08a0e5d20f5d0bd1654d1cb

    SHA256

    052b01b1cbe8fbd4892ef56eff276535be106e11098de89ca3b8d96fc861e5bf

    SHA512

    67d872e3bdf01fdd86c49507eb96329603b0d93d32bde02f511f736308d4bec97ae1e84a2284231ed350cc02deb43c95ee3d214ffcf237601c4cfdbe848beda2

  • C:\Users\Admin\AppData\Local\Temp\parent.txt

    Filesize

    449KB

    MD5

    4ba998ebb14caf9d3abe087a55b3b170

    SHA1

    cc44fd5bf32dac8fdc59be33ad2d9f38f81dfc3f

    SHA256

    e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af

    SHA512

    aefb97df4462bfbe2958f72cbcb8124afe94e02734661e2270fc5968214e11f8888bd7037d0e14f2029154ce9fffc6655b8b657c648ce30d7d0e7d36a4409ff9

  • memory/1072-134-0x0000000075260000-0x0000000075811000-memory.dmp

    Filesize

    5.7MB

  • memory/1072-136-0x0000000075260000-0x0000000075811000-memory.dmp

    Filesize

    5.7MB