Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2022, 08:59

General

  • Target

    3defb5cff41e81c85e8d6324516c06ae540b619544eae12d4d4f9bffb55665e4.exe

  • Size

    502KB

  • MD5

    814c70f8b18a0d186bb624383341ef40

  • SHA1

    1d94f47a0e4e233ef3eb5a26c8d85918571c6063

  • SHA256

    3defb5cff41e81c85e8d6324516c06ae540b619544eae12d4d4f9bffb55665e4

  • SHA512

    ef48797f2e48f016c20b4c12ccbf0dcb5a82d18e004c2822b9dd1082700d37036e4888a233215639e2db8e4d6870b8548f1e2217c92ca1c23a518a0f363fd3ff

  • SSDEEP

    12288:duRL1zkKjvGN8pUipNICsPEyfJG6Hcry0r7Cp:kXzXqNriXrsvfGy0XCp

Score
9/10

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3defb5cff41e81c85e8d6324516c06ae540b619544eae12d4d4f9bffb55665e4.exe
    "C:\Users\Admin\AppData\Local\Temp\3defb5cff41e81c85e8d6324516c06ae540b619544eae12d4d4f9bffb55665e4.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    PID:4652
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4880

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4652-132-0x0000000000F70000-0x0000000000F82000-memory.dmp

      Filesize

      72KB

    • memory/4652-133-0x0000000000270000-0x000000000032C000-memory.dmp

      Filesize

      752KB

    • memory/4652-134-0x0000000000F70000-0x0000000000F82000-memory.dmp

      Filesize

      72KB

    • memory/4652-135-0x0000000000F70000-0x0000000000F73000-memory.dmp

      Filesize

      12KB

    • memory/4652-136-0x0000000000270000-0x000000000032C000-memory.dmp

      Filesize

      752KB

    • memory/4652-137-0x0000000000270000-0x000000000032C000-memory.dmp

      Filesize

      752KB